Qualys has disclosed CVE-2026-64600, nicknamed RefluXFS, a race condition in the Linux kernel’s XFS filesystem copy-on-write path that lets an unprivileged local user overwrite the contents of any readable file on a reflink-enabled XFS volume, including /etc/passwd or SUID-root binaries, to gain full root access. The flaw triggers when two concurrent O_DIRECT writes target the same reflinked file, and it lands at the filesystem allocation layer, below standard memory protections. Qualys estimates the bug potentially affects more than 16.4 million systems across RHEL, Oracle Linux, Amazon Linux, CentOS Stream, Rocky Linux, AlmaLinux, and Fedora Server. A fix merged into the upstream kernel on July 16 and distributions are now backporting it; Qualys has not published working exploit code.
The scale here comes from how ordinary the vulnerable configuration is. XFS with reflink support is a common default on modern enterprise and cloud Linux images, not a niche setup, and the flaw works beneath kernel protections like KASLR, SMEP, and SMAP rather than around them. Qualys says there is no reliable temporary mitigation short of patching and rebooting, which puts pressure on fleets that batch kernel updates on a slower cadence.
RefluXFS also extends a pattern CyberTech has been tracking in cloud-common Linux distributions: it is the second kernel privilege-escalation flaw this year, alongside DirtyClone’s silent root escalation on cloud and Kubernetes hosts, to reach root by abusing copy-on-write semantics rather than a classic memory-safety bug. That repetition suggests security teams auditing kernel exposure should treat copy-on-write code paths across filesystems as a distinct review category, not a one-off finding to patch and forget.
Source: Qualys Threat Research Unit
