CVE-2026-64600: RefluXFS Linux Kernel Flaw Can Lead to Root Privilege Escalation

Linux local privilege escalation bugs remain especially dangerous when they turn an ordinary user foothold into full root access. CVE-2026-64600, also referred to as the RefluXFS vulnerability and the RefluXFS Linux Kernel Vulnerability, is a race condition in the Linux kernel’s XFS copy-on-write path that allows an unprivileged local attacker to overwrite protected files on disk and gain host root privileges.

The issue is notable because exploitation does not rely on memory corruption in the traditional sense, nor does it require bypassing modern hardening controls through a separate chain. Instead, the flaw abuses concurrent O_DIRECT writes against a reflink-enabled XFS volume, making it possible to corrupt on-disk data directly. In practical terms, this means the resulting privilege escalation can persist across reboots and leave extremely limited forensic evidence.

CVE-2026-64600 analysis

For CVE-2026-64600 analysis, the core problem lies in a race condition in the XFS filesystem’s copy-on-write path. When two concurrent O_DIRECT writes target the same reflinked file, the kernel can briefly drop the inode lock while waiting for transaction log space. During that window, a second writer can complete its own remap operation and alter the reference state of the original block. When the first writer resumes, it may trust stale metadata and write directly to the original block instead of a private copy.

That logic error is what allows an unprivileged local attacker to overwrite the on-disk contents of any readable file on an affected XFS volume. A successful attack can target high-value files such as /etc/passwd or SUID-root binaries, converting filesystem corruption directly into root access. The public CVE-2026-64600 PoC demonstrated this against a default RHEL 10.2 deployment by stripping the root account’s password requirement within seconds.

From an exposure standpoint, CVE-2026-64600 affects systems only when three conditions are met: the kernel is version 4.11 or later and unpatched, the filesystem uses XFS with reflink=1 enabled, and the attacker has a writable location on the same filesystem as a high-value target. This makes the flaw especially relevant for enterprise Linux deployments that use XFS by default.

At the moment, public CVE-2026-64600 IOCs are limited. Qualys specifically noted that exploitation leaves no kernel log output, which makes CVE-2026-64600 detection difficult through traditional log-based approaches. That is why the most reliable way to detect CVE-2026-64600 exposure is through configuration and version assessment rather than waiting for post-exploitation evidence.

CVE-2026-64600 Mitigation

The most important CVE-2026-64600 mitigation step is to apply vendor kernel updates immediately and reboot the system so the patched kernel is actually in use. Qualys states that vendor-fixed kernels are already available and being backported across major enterprise Linux distributions, and that there are currently no reliable temporary workarounds or configuration-only mitigations.

Because the issue depends on XFS with reflink enabled, security teams should prioritize systems where XFS is used as the root filesystem or where writable unprivileged directories coexist with high-value protected targets on the same volume. In practice, CVE-2026-64600 detection should focus on identifying affected distributions, checking whether XFS reflink is enabled, and verifying that patched kernels have been installed and activated after a reboot.

CHECK AVAILABLE DETECTIONS

Disclaimer: Detection content may not be available for every CVE. Check the SOC Prime Platform for current coverage. If you don’t find relevant detections now, please check back later.