RefluXFS: A Critical Linux Kernel Flaw Grants Unprivileged Users Root Access on XFS Filesystems

A newly disclosed Linux kernel vulnerability, dubbed RefluXFS and officially designated as CVE-2026-64600, poses a significant threat to a wide range of Linux distributions by allowing unprivileged local users to overwrite critical root-owned files and gain persistent root access. The flaw, discovered by cybersecurity firm Qualys and publicly detailed on July 22, exploits a race condition within the XFS filesystem’s reflink functionality, a feature designed for efficient file copying.

The exploit’s mechanism hinges on a subtle but dangerous interaction between concurrent file operations. An attacker can leverage a race condition during copy-on-write (COW) operations initiated by XFS reflinks. By cloning a root-owned file into a temporary "scratch" file using the FICLONE operation—which requires only read access to the source—and then initiating concurrent direct I/O writes to this clone, an attacker can manipulate the filesystem’s block mapping. XFS reflinks initially share physical disk blocks between the original and cloned files. However, during a specific window in the COW process, where the kernel reads the data-fork mapping under an inode lock, a second writer can complete the COW operation and remap the cloned file to new disk blocks. When the first writer reacquires the lock, it refreshes its copy-on-write fork but continues to operate with the stale data-fork mapping. This stale mapping, now pointing to a block exclusively owned by the original protected file, allows the direct write to bypass intended targets and land directly in the root-owned file, effectively overwriting it without altering its ownership, permissions, or timestamps. This means a compromised setuid-root binary, for instance, could be replaced with a malicious version that still executes with root privileges.

Qualys highlighted that default installations of prominent Linux distributions, including Red Hat Enterprise Linux (RHEL) and its derivatives such as Fedora Server, Oracle Linux, CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux (versions 8, 9, and 10), are susceptible. Amazon Linux 2023 and Amazon Linux 2 images from December 2022 onwards are also identified as vulnerable. The exploitation of RefluXFS can result in the overwriting of crucial files like /etc/passwd, which controls user account information, or setuid-root binaries, granting the attacker complete control over the system.

The Genesis of RefluXFS: A Journey Through Kernel History

The vulnerability’s roots trace back to Linux kernel version 4.11, released in 2017. The fix for RefluXFS, merged on July 16, 2026, explicitly references commit 3c68d44a2b49 as the origin of the bug and a stable backport request marked # v4.11, indicating that this flaw has persisted in the kernel for nearly a decade. This long gestation period underscores the complexity of kernel development and the challenges in identifying subtle race conditions that only manifest under specific, concurrent operational scenarios. The extended lifespan of such a critical vulnerability also raises questions about the effectiveness of current code auditing and testing methodologies, especially for foundational components like the Linux kernel.

Conditions for Exploitation: A Targeted Threat

Exploitation of RefluXFS is not universal and requires the fulfillment of three specific conditions:

• XFS Filesystem with Reflink Support: The target system must be utilizing the XFS filesystem, and this filesystem must have the reflink feature enabled. Reflinks, introduced in kernel 4.11, allow for efficient data duplication by creating new file entries that initially point to the same physical disk blocks as the source file, employing a copy-on-write mechanism.
• Attackable Host: An unprivileged local user must be able to execute code on the target system. This could be achieved through various means, including a shell account, a compromised service, or within a CI/CD pipeline.
• Race Condition Window: The critical race condition must occur. This happens when a root-owned file is cloned, and concurrent direct I/O writes are performed on the clone while the kernel is managing the data-fork mapping under an inode lock.

Qualys has strongly advised prioritizing patching for exposed and multi-tenant systems, particularly any reflink-enabled XFS host where untrusted code can be executed locally. This includes cloud environments, shared hosting platforms, and development servers where isolation between users or processes might be less stringent.

Distributions at Risk: A Detailed Breakdown

The advisory from Qualys provides a clear picture of which default installations are most vulnerable. Beyond the general mention of RHEL derivatives, specific distributions and versions are identified:

• Red Hat Enterprise Linux (RHEL): RHEL 8, 9, and 10 are directly affected.
• Fedora Server: Versions 31 and later are vulnerable.
• Amazon Linux: Amazon Linux 2023 and Amazon Linux 2 images released from December 2022 onwards are at risk.
• Other RHEL Derivatives: CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, and CloudLinux 8, 9, and 10 are also listed.

It is important to note that RHEL 7 systems are not affected because their XFS filesystems predate the introduction of reflink support.

Distributions that do not typically use XFS for their root filesystem by default, such as Debian, Ubuntu, SUSE Linux Enterprise Server (SLES), and openSUSE, are exposed only if an administrator manually configured XFS with reflink enabled during the installation process. Users of these distributions can check their root filesystem using the command:

xfs_info / | grep reflink=

If the output shows reflink=1, it indicates that condition two is met. A similar check should be performed on any other mounted XFS volume where a protected file and an attacker-writable directory coexist on the same filesystem.

The Technical Nuance: Understanding the "Stale Mapping"

The core of the RefluXFS vulnerability lies in what Qualys describes as a "stale mapping." When an attacker clones a root-owned file using FICLONE, both the original and the clone initially point to the same physical disk blocks. The kernel then enters a critical section to handle the copy-on-write process. During this phase, it acquires an inode lock to read the data-fork mapping. While this lock is held, the kernel reserves transaction space. Crucially, a second writer can exploit a gap in this locking mechanism.

During this window, the second writer can complete its copy-on-write operation, remapping the cloned file to entirely new disk blocks. When the first writer eventually reacquires the inode lock, it attempts to refresh the copy-on-write fork. However, due to the race, it continues to use the old, now "stale," data-fork mapping. This stale address points to a block that was part of the original, root-owned file and is now considered unshared by the XFS filesystem. The filesystem, unaware of the remapping that occurred during the lock cycle, permits the direct write operation. Consequently, data intended for the attacker’s cloned file is instead written to the original, root-owned file, leading to its corruption or complete overwrite.

The upstream patch, committed to the Linux kernel, addresses this by introducing a mechanism to snapshot the i_df.if_seq (inode data fork sequence number) before the lock is dropped. If this sequence number has changed upon reacquiring the lock, indicating a modification to the data fork, the system re-reads the data fork using xfs_bmapi_read(). This ensures that the kernel is always working with the current, valid block mapping, thereby preventing the stale mapping issue.

The use of direct I/O is particularly insidious here, as it bypasses the page cache and lacks revalidation hooks, allowing the write to directly hit the disk. Because the operation targets the block layer and not the file inode directly, filesystem metadata is not updated, leaving no obvious kernel warnings or log entries to signal the intrusion. Qualys researchers noted that in their tests, the race typically completed in under ten seconds, and they successfully demonstrated the exploit by removing the root password on a default RHEL 10.2 installation.

AI’s Role in Discovery: A New Frontier in Vulnerability Research

Intriguingly, the discovery of RefluXFS was aided by artificial intelligence. Qualys revealed that an AI model, specifically Anthropic’s Claude Mythos Preview, played a significant role in identifying the vulnerability. The researchers tasked the restricted-access frontier model with finding a vulnerability similar to the infamous "Dirty COW" (CVE-2016-5195) in the Linux kernel. The AI not only located the race condition but also generated a working root exploit and drafted the initial advisory. This marks a significant development in vulnerability research, showcasing the potential of AI in uncovering complex software flaws. The Qualys team then reproduced the findings on a standard Fedora Server 44 installation, verified the AI’s reasoning, and coordinated the disclosure with upstream developers.

A Pattern of Discovery: Qualys’s Persistent Pursuit of Kernel Flaws

This is not the first significant kernel vulnerability Qualys has uncovered this year. The firm has been consistently identifying older, deeply embedded flaws. Just a day prior to the RefluXFS disclosure, Qualys reported a snap-confine flaw in Ubuntu Desktop (CVE-2026-8933), which also allowed local privilege escalation to root. In May, the company highlighted a nine-year-old bug within the kernel’s ptrace checks, demonstrating that even seemingly well-established security mechanisms can harbor long-standing vulnerabilities. This sustained effort by Qualys underscores the ongoing need for rigorous security auditing of core system components.

Timeline of Disclosure and Patching

The discovery and remediation of RefluXFS followed a structured process:

• Pre-July 16, 2026: The vulnerability exists in Linux kernel versions dating back to 4.11 (2017).
• July 10, 2026: Red Hat’s bug tracker logs the flaw under the title "kernel: XFS data corruption using reflink," automatically imported and initially described as potential data corruption.
• July 14, 2026: Red Hat begins issuing kernel advisories (RHSA-2026:39179, RHSA-2026:39180 for RHEL 8; RHSA-2026:39494 for RHEL 10), with extended-support and SAP streams following by July 17. These patches are available before the vulnerability is publicly named.
• July 16, 2026: The fix for RefluXFS is merged into the upstream Linux kernel.
• July 22, 2026: Qualys publicly discloses RefluXFS (CVE-2026-64600) and publishes its technical advisory. A public proof-of-concept is logged on Red Hat’s tracker, referencing the oss-security mailing list.
• July 23, 2026: Debian’s security tracker lists the fix in its Trixie-security and unstable branches, while older branches remain vulnerable.

Official Responses and Patching Guidance

Major Linux vendors have begun rolling out patches to address RefluXFS. Red Hat, a primary target due to its widespread use in enterprise environments, has issued "Important"-rated kernel advisories. These errata were released to RHEL 8, 9, and 10 streams starting on July 14, eight days before the coordinated public disclosure. System administrators are urged to verify that advisories exist for their specific RHEL release and to apply them promptly.

For Debian users, the security tracker indicates that the fix is available in the trixie-security branch as kernel version 6.12.96-1 and in the unstable branch as 7.1.4-1. However, older branches like bookworm and bullseye, including their security updates, were still marked as vulnerable as of July 23.

Crucially, applying a vendor update does not immediately replace the running kernel in memory. To fully mitigate the RefluXFS vulnerability, systems must be rebooted after the patched kernel package has been installed. Users should verify that their system is indeed running the fixed kernel version after the reboot.

Mitigation and Limitations: What to Know

Qualys has stated that there are no practical workarounds or temporary configuration changes that can disable XFS reflinks after a filesystem has been created. Standard security measures such as SELinux in enforcing mode, seccomp, kernel lockdown, and container boundaries were ineffective against this exploit in Qualys’s testing. Memory protection mechanisms like KASLR (Kernel Address Space Layout Randomization) and SMEP (Supervisor Mode Execution Prevention) are also not applicable, as the vulnerability exploits a block-layer write rather than memory corruption.

There is, however, one apparent limitation: the race condition can only be triggered if the target file’s initial block mapping is unshared. This means that files that have already been subjected to a reflink copy operation by an administrator are not susceptible to this specific exploit. Additionally, setuid-root binaries are generally not reflinked, making them less likely targets for this particular attack vector. However, an unprivileged user can potentially reset this condition by executing chsh (change shell), which can modify user-owned files and thus create a scenario where the race condition can be exploited.

While Qualys has not released standalone exploit code, a public proof-of-concept was made available through Red Hat’s bug tracker, detailing the race and exploitation steps. As of the time of reporting, no exploitation of RefluXFS in the wild had been reported by any of the vendors tracking the flaw.

Broader Implications and Future Concerns

The RefluXFS vulnerability highlights several critical points for the cybersecurity landscape:

• The Persistent Threat of Legacy Flaws: The fact that a vulnerability originating from kernel 4.11 could remain undiscovered and unaddressed for nearly a decade is a stark reminder of the deep-seated nature of some security issues in complex software.
• The Evolving Role of AI in Security: The discovery of RefluXFS with AI assistance signals a new era in cybersecurity, where AI tools are becoming active participants in both offensive and defensive security research. This necessitates a proactive approach to understanding and leveraging AI for threat detection and mitigation.
• The Importance of Proactive Patching: The vendor advisories were released prior to public disclosure, underscoring the value of diligent patch management. Organizations that adhere to timely patching schedules were already protected before the vulnerability was widely known.
• The Complexity of Filesystem Security: XFS reflink functionality, while offering performance benefits, introduces complex interactions that can lead to subtle yet critical security vulnerabilities. This emphasizes the need for rigorous testing and auditing of advanced filesystem features.

The RefluXFS vulnerability serves as a potent reminder that even well-established operating systems like Linux are not immune to critical security flaws. Prompt patching and a thorough understanding of system configurations are paramount for maintaining a secure environment. The ongoing efforts of researchers like Qualys, combined with the emerging capabilities of AI, will continue to shape the future of cybersecurity in the face of ever-evolving threats.