RefluXFS Linux Kernel Vulnerability Lets Attackers Gain Root Access

Cybersecuritynews •Guru Baran • July 22, 2026

A new Linux vulnerability dubbed “RefluXFS” is a race condition in the Linux kernel’s XFS filesystem copy-on-write path that lets an ordinary local user silently overwrite protected system files and seize host root privileges, even on systems running SELinux in Enforcing mode. The vulnerability tracked as CVE-2026-64600 uncovered by Qualys Threat Research Unit (TRU) exploits […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RefluXFS Flaw Exposes Millions of Linux Systems to Root Takeover A critical vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local users to gain root access by exploiting a race condition in the copy-on-write path. This flaw affects over 16 million systems using Red Hat Enterprise Linux and its derivatives, including Oracle Linux and Amazon Linux, all of which have reflink enabled by default. The vulnerability enables attackers to overwrite protected files without detection, as the modifications persist across reboots and leave no kernel log output. The flaw has existed since kernel version 4.11, released in 2017, and was patched on July 16, 2026, just days before its public disclosure. Qualys Threat Research Unit discovered the flaw and reported it on July 22, 2026. Immediate action is required to apply the patch and reboot affected systems to mitigate the risk. 13 sources 73

Extracted Entities

RefluXFS Linux Kernel Vulnerability Lets Attackers Gain Root Access

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (2)

Platforms (1)

Vulnerabilities (1)