A newly discovered flaw in the Linux kernel, identified as CVE-2026-64600, poses a significant security risk by allowing unprivileged local users to gain root access. This vulnerability, known as RefluXFS, affects systems using the XFS filesystem and was disclosed on July 22. It enables attackers to overwrite files owned by the root, potentially compromising systems running Red Hat Enterprise Linux (RHEL), Fedora Server, and Amazon Linux.
Vulnerability Details and Impact
Qualys, a security firm, highlighted that default installations of several Linux distributions are vulnerable to this exploit. The flaw allows attackers to race against critical system files like /etc/passwd and setuid-root binaries, ultimately leading to persistent root access. The attack operates at the block layer, preserving file ownership and permissions, and remains effective even after a system reboot.
The fix for this vulnerability was integrated into the Linux kernel on July 16. Vendors have started distributing patched kernels to mitigate the risk. The issue is traced back to a bug in Linux version 4.11, introduced in 2017, which has now been addressed in recent updates.
Who Is Affected?
The vulnerability affects systems running Linux kernel version 4.11 or later without the RefluXFS patch. Affected setups involve XFS filesystems created with reflink enabled. Qualys advises prioritizing patches for systems hosting multi-tenant environments or executing untrusted code locally. Specific distributions potentially exposed include RHEL, CentOS Stream, Oracle Linux, and Amazon Linux, among others.
Notably, Debian, Ubuntu, SLES, and openSUSE generally do not use XFS for their root filesystems by default, which limits their exposure unless XFS was explicitly chosen during installation.
Technical Breakdown of the Exploit
The exploit involves cloning a root-owned file into a temporary file using the FICLONE command. Attackers can then execute concurrent writes that exploit the copy-on-write mechanism of XFS, potentially redirecting data intended for a clone onto a protected file. This check-then-use error occurs due to stale mappings during lock cycles, allowing unauthorized modifications to critical files.
The patch addresses this by ensuring the data-fork mappings are revalidated before any copy-on-write operations proceed. This prevents attackers from exploiting stale mappings to overwrite sensitive files.
Mitigation and Future Outlook
To protect affected systems, users must apply the latest kernel updates and reboot their systems to implement the fix. Red Hat has released advisories for RHEL 8, 9, and 10, detailing the necessary updates. It is crucial for administrators to check their systems’ patch status and apply fixes promptly.
While no reports of active exploitation in the wild have surfaced, organizations should remain vigilant and ensure all relevant updates are applied. This incident underscores the importance of timely patch management and system monitoring to safeguard against emerging threats.
