A critical vulnerability named ‘RefluXFS’ has been identified in the Linux kernel, specifically affecting the XFS filesystem. This flaw allows local users to overwrite protected system files, gaining root access even on systems with SELinux in Enforcing mode.
RefluXFS, tracked as CVE-2026-64600, was discovered by the Qualys Threat Research Unit. It exploits a race condition triggered during concurrent O_DIRECT writes to the same reflinked file on an XFS volume, leading to potential unauthorized access.
Technical Details of RefluXFS
The XFS filesystem typically manages writes to shared blocks by creating a new block and remapping the file. However, a timing issue arises when the kernel drops its inode lock while waiting for transaction log space, creating a brief window for exploitation.
During this window, a second writer can remap the file and drop the reference count, causing the first writer to write directly to the original block. This results in a corrupted write that bypasses the page cache and lands permanently on disk.
Impact and Affected Systems
This vulnerability allows any unprivileged local user to overwrite files on a reflink-enabled XFS volume, potentially granting root access. A proof-of-concept demonstrated by Qualys showed that a default RHEL 10.2 system could be compromised silently and quickly, with changes persisting across reboots.
The flaw affects every mainline and stable Linux kernel version since 4.11, impacting over 16.4 million systems worldwide. Systems are vulnerable if they meet specific conditions, such as having a writable directory by unprivileged users and a high-value target like a SUID-root binary.
Mitigation and Future Outlook
RefluXFS operates at the filesystem allocation layer, beyond the reach of traditional kernel hardening methods. Current security mechanisms like KASLR, SMEP, and SMAP do not mitigate this vulnerability, and there is no reliable workaround other than applying patches.
Qualys and Anthropic jointly discovered this vulnerability through a research initiative that utilized AI to identify race conditions. This approach reflects a growing trend in AI-accelerated vulnerability research, leading to significant disclosures in 2026.
Organizations are urged to prioritize patching, especially for internet-facing and multi-tenant systems. Vendor-fixed kernels are available and should be applied, followed by a full system reboot to ensure the fix is active.
