Critical RefluXFS Vulnerability Exposes Millions of Linux Systems to Root Takeover

A critical flaw in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local users to gain root access on systems running Red Hat Enterprise Linux and its derivatives. The vulnerability, discovered by Qualys Threat Research Unit, affects over 16 million systems worldwide. It exploits a race condition during concurrent direct I/O operations, enabling attackers to overwrite protected files without detection. The flaw has existed since kernel version 4.11, released in 2017, and was patched on July 16, 2026. Affected distributions include RHEL, Oracle Linux, and Fedora. Standard security measures like SELinux and container isolation do not mitigate this vulnerability. Immediate action is required to apply the patch and reboot systems to prevent exploitation.

Key Points: • CVE-2026-64600 allows local users to gain root access on affected Linux systems. • The vulnerability affects over 16 million systems running XFS with reflink enabled. • Standard security defenses are ineffective against this flaw, necessitating urgent patching.