A nine-year-old Linux kernel XFS race condition tracked as CVE-2026-64600 lets local attackers overwrite protected files and gain root privileges, and Qualys dubbed the flaw RefluXFS. The issue affects many major enterprise Linux systems with XFS reflink enabled, persists across reboots, and has already been patched in the Linux kernel. #RefluXFS #CVE-2026-64600 #XFS #LinuxKernel
Keypoints
- RefluXFS is a Linux kernel XFS race condition vulnerability.
- It can let local attackers overwrite protected files and obtain root privileges.
- The flaw affects XFS with reflink enabled on Linux kernel v4.11 and later.
- SELinux, kernel lockdown, container isolation, KASLR, SMEP, and SMAP do not stop the attack.
- Qualys says the exploit is reliable, silent, survives reboot, and requires immediate patching.