Back Feeds.4Sysops

Critical RefluXFS vulnerability allows local privilege escalation on XFS filesystems

Feeds.4Sysops •IT News • July 23, 2026

The RefluXFS vulnerability, tracked as CVE-2026-64600, is a serious race-condition flaw residing in the Linux kernel’s XFS filesystem copy-on-write path. Affecting kernel versions 4.11 and later, the bug allows an unprivileged local user to overwrite protected system files by exploiting a timing window during concurrent direct I/O operations. Because the manipulation occurs at the block layer, it effectively bypasses common security controls, including SELinux, kernel lockdown, and standard memory protections. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RefluXFS Flaw Exposes Millions of Linux Systems to Root Takeover A critical vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local users to gain root access by exploiting a race condition in the copy-on-write path. This flaw affects over 16 million systems using Red Hat Enterprise Linux and its derivatives, including Oracle Linux and Amazon Linux, all of which have reflink enabled by default. The vulnerability enables attackers to overwrite protected files without detection, as the modifications persist across reboots and leave no kernel log output. The flaw has existed since kernel version 4.11, released in 2017, and was patched on July 16, 2026, just days before its public disclosure. Qualys Threat Research Unit discovered the flaw and reported it on July 22, 2026. Immediate action is required to apply the patch and reboot affected systems to mitigate the risk. 13 sources 73

Extracted Entities

Critical RefluXFS vulnerability allows local privilege escalation on XFS filesystems

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)