Linux Merges Fix for XFS Root Bug Affecting 16.4 Million Systems

3 articles · Updated · Network World · Jul 23

A July 16 upstream kernel patch addresses CVE-2026-64600, an XFS race condition that can let an unprivileged local user gain root by overwriting readable files at the block layer.
The flaw hits Linux 4.11 and later when XFS reflink is enabled: two concurrent writes to a reflinked file can bypass copy-on-write protections and alter the original file directly on disk.
Qualys said the bug has existed since 2017, carries a CVSS score of 7.8, exploits reliably, survives reboots, and leaves no kernel log output.
RHEL, CentOS Stream, Oracle Linux, Rocky, AlmaLinux, CloudLinux, Amazon Linux, Fedora Server, and some Debian, Ubuntu, and SUSE systems are affected; KASLR, SMAP, SMEP, kernel lockdown, SELinux, and seccomp do not stop it.
Vendors are backporting the fix into supported kernels, and organizations using affected XFS deployments need to install updated kernels and fully reboot systems once patches are available.

Sources

Network World22h ago

Linux XFS Race Condition (CVE-2026-64600) Enables Root Access; Fix Merged

penligent.ai22h ago

CVE-2026-64600 RefluXFS, The XFS Reflink Race Behind a Root Write Primitive

The Hacker News14h ago

Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

4 Sources

If security tools are blind to this exploit, how can you know if your Linux systems are already compromised?

Does this 'silent' vulnerability that bypasses all defenses signal a new era of undetectable kernel attacks?

How are AI models finding decade-old Linux security flaws that have long eluded human experts?

RefluXFS (CVE-2026-64600): Critical Linux Privilege Escalation Threat Exposes Over 16 Million Systems—Immediate Action Required

Overview

The RefluXFS vulnerability (CVE-2026-64600), identified on July 22, 2026, is an immediate and critical threat that demands urgent attention from system administrators. To mitigate potential risks, swift and decisive action is required, starting with scanning all Linux endpoints using Qualys QID(s) and prioritizing the patching of internet-facing assets. These systems are the most exposed and attractive targets for attackers, so securing them first ensures the most vulnerable entry points are protected promptly. The call for immediate action highlights the severe implications of RefluXFS and the need for rapid response.

...