Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs
Summary: RefluXFS, a Linux kernel flaw disclosed July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access, and Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux can meet the conditions for exploitation. The fix was merged on July 16 and traces the bug to Linux 4.11 in 2017; Qualys said an AI model, Claude Mythos Preview, found the race, wrote a working root exploit, and drafted the advisory, which the team changed very little.
What you should know: There is no mount option or sysctl that disables XFS reflinks after a filesystem is created, and Qualys said SELinux in Enforcing mode, seccomp, kernel lockdown, and container boundaries all failed to stop it in testing - so any reflink-enabled XFS host where untrusted code runs locally, whether a shell, a CI job, or a compromised service, is the exposure to patch first.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-64600
- Related
- RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) | Qualys Cyber Risks ·⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, Click Fix Lures and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026