RefluXFS: 9-Year-Old Linux Flaw Grants Root on Default RHEL Systems

Qualys has disclosed a nine-year-old Linux kernel vulnerability, tracked as CVE-2026-64600 and nicknamed RefluXFS, that enables unprivileged local users to overwrite root-owned files on XFS filesystems and escalate to full root privileges. The flaw, introduced in Linux 4.11 via commit 3c68d44a2b49 back in 2017, was patched upstream on July 16 and stems from a stale data-fork mapping race condition in the kernel's reflink copy-on-write handling. Qualys demonstrated successful exploitation against /etc/passwd and setuid-root binaries, showing that the overwrite survives reboots while leaving ownership, permissions, timestamps, and the setuid bit completely intact, meaning a tampered binary still executes as root.

The root cause lies in how XFS handles reflink operations. An attacker clones a root-owned file into a scratch location using the FICLONE ioctl, which requires only read access on the source. Both files initially share the same physical disk blocks through copy-on-write. The kernel then reads the data-fork mapping under the inode lock and passes it to xfs_reflink_fill_cow_hole(), which drops the lock to reserve transaction space. During that window, a second concurrent O_DIRECT writer can complete the copy-on-write and remap the cloned file to a new block. When the first writer reacquires the lock, it refreshes the copy-on-write fork but continues writing to the stale, now-unmapped address, effectively allowing the attacker to write arbitrary data into a block originally belonging to the protected file. Since /etc/passwd is a common target, administrators should use a password strength checker to audit whether their credential files have been silently tampered with.

Exploitation requires three conditions: a system running Linux 4.11 or later without the RefluXFS fix, an XFS filesystem created with reflink=1, and both the readable target file and an attacker-writable directory residing on the same XFS filesystem. Qualys warned that default installations of Red Hat Enterprise Linux 8, 9, and 10, along with CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Fedora Server 31 and later, Amazon Linux 2023, and Amazon Linux 2 images shipped from December 2022 onward, all meet these conditions out of the box. RHEL 7 is immune because it predates XFS reflink support, while Debian, Ubuntu, SLES, and openSUSE are only affected if an administrator manually selected XFS with reflink enabled during installation. Administrators can verify exposure by running `xfs_info / | grep reflink=`, where a `reflink=1` result confirms the second condition is met.

Multi-tenant environments and any system where untrusted code can execute locally, whether through a shared shell, a CI pipeline, or a compromised web service, should be patched immediately. Given that successful exploitation can persist across reboots undetected, security teams are advised to perform integrity checks on critical system files and conduct network port scans to identify any backdoors that may have been planted following a privilege escalation. For organizations verifying vendor patch status across their Linux fleet, a WHOIS lookup on registered infrastructure domains can help confirm distribution origins and ensure updates are sourced from legitimate mirrors rather than attacker-controlled repositories.