Nine-year-old Linux kernel flaw exposes 16 million systems to root takeover
Qualys Threat Research Unit $QLYS disclosed RefluXFS (CVE-2026-64600), a nine-year-old race condition in the Linux kernel's XFS filesystem that lets local users gain root access. It affects XFS deployments with reflink enabled, the default on RHEL, Oracle Linux, Amazon Linux and
Researchers at Qualys' Threat Research Unit $QLYS disclosed a Linux kernel vulnerability dubbed RefluXFS, tracked as CVE-2026-64600. The flaw is a race condition in the XFS filesystem's copy-on-write path that has existed since kernel version 4.11, introduced in February 2017. It allows an unprivileged local user to overwrite protected files, including SUID-root binaries or /etc/passwd, and gain root access, with the change persisting across reboots and leaving no kernel log output. It affects any distribution running XFS with reflink enabled, the default configuration on RHEL, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Amazon Linux and Fedora Server. Qualys estimates more than 16.4 million systems are potentially affected. Standard defenses including SELinux, kernel lockdown, container isolation, and memory protections like KASLR, SMEP and SMAP do not block the attack because it operates at the filesystem allocation layer. A fix was merged into the Linux kernel source tree on July 16, 2026, six days before public disclosure on July 22. Vendor-patched kernels are now being backported to affected distributions; there is no workaround short of patching and rebooting. Source: Qualys Threat Research Unit (blog.qualys.com), BleepingComputer.