XFS Weakness Impacts RHEL and Related Distros

posted by Roy Schestowitz on Jul 24, 2026

• Network World ☛ Linux XFS has a decade-old race condition allowing full root access

  Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access.

  The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data.

• Hacker News ☛ Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

  RefluXFS, a Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access.

  Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux can meet the conditions for exploitation.

• Bleeping Computer ☛ New RefluXFS Linux flaw lets attackers gain root privileges

  A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.

  Dubbed RefluXFS by the Qualys Threat Research Unit (TRU), which found and reported it, the security flaw affects systems with an XFS filesystem with reflink enabled (a default configuration on major enterprise Linux distributions), running Linux kernel v4.11 or later, with a directory writable by an unprivileged local user, and a high-value target (a root-owned configuration file or SUID-root binary).

• Tech Times ☛ Linux Kernel Flaw Exposes 16 Million RHEL Systems to Silent Root Takeover

  If your enterprise servers run Red Hat Enterprise Linux or a close derivative — Oracle Linux, AlmaLinux, Rocky Linux, Fedora Server, Amazon Linux 2023 — there is a nine-year-old flaw in their default filesystem that lets any local user, with nothing more than a shell account, silently overwrite protected system files and gain full root access. The modification survives reboots. It leaves no kernel log output. And every standard Linux defense you have deployed — SELinux in enforcing mode, container boundaries, kernel memory protections, seccomp profiles — is structurally blind to it, because it operates at a layer those defenses were never designed to reach.

• Linux kernel flaw lets local users gain root access

  Qualys has disclosed a Linux kernel vulnerability called RefluXFS that could allow a local user to gain root privileges on affected systems. The flaw may affect more than 16.4 million systems worldwide.

  Tracked as CVE-2026-64600, the vulnerability lies in the XFS filesystem copy-on-write path and has been present since Linux kernel 4.11. It affects XFS-based environments across distributions including Red Hat Enterprise Linux, Oracle Linux, Amazon Linux and Fedora. Debian, Ubuntu and SUSE can also be exposed if administrators choose XFS with reflink enabled.

• Qualys ☛ RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)

  Qualys Threat Research Unit (TRU) identified CVE-2026-64600, a race condition in the Linux kernel’s XFS filesystem copy-on-write path. An attacker with an ordinary local account can exploit this race condition to overwrite protected files on disk and gain host root privileges on affected systems, including deployments running SELinux in Enforcing mode.

  This discovery emerged from a structured research initiative between Qualys and Anthropic, where we integrated Claude Mythos Preview into our manual audit workflow to accelerate our research while maintaining strict human oversight.