RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) | Qualys

Summary: Qualys Threat Research Unit identified CVE-2026-64600, a race condition in the Linux kernel's XFS copy-on-write path that lets an unprivileged local user overwrite any readable file on a reflink-enabled XFS volume at the block layer and gain host root. The flaw has been present since kernel version 4.11 (circa 2017), affects default installations of RHEL, Oracle Linux, Amazon Linux, and Fedora, and Qualys estimates it potentially impacts over 16.4 million systems.
Bottom line: Exploitation is reliable, leaves no kernel log output, survives a reboot, and works under SELinux Enforcing, container boundaries, and standard kernel hardening - and Qualys states there are no practical mitigations or temporary configuration changes, only kernel patching and a full reboot.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-64600
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026