CVE-2026-64600: 
Linux Kernel Schwachstellenanalyse und -minderung

CVE-2026-64600, dubbed RefluXFS, is a race condition vulnerability in the Linux kernel's XFS filesystem reflink subsystem that allows a local attacker to escalate privileges to root. The flaw was introduced in Linux kernel 4.11 and was publicly disclosed on July 23, 2026, after being discovered and reported by Qualys. Affected kernel versions span from 4.11 through multiple stable branches, with fixes backported to 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a TOCTOU (Time-of-Check Time-of-Use) race condition (CWE-367) in the XFS reflink helpers xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc. Both functions cycle the ILOCK (inode lock) to acquire a transaction, which invalidates the data fork and COW fork mappings held at the time of the lock release. While the COW fork mapping is refreshed via xfs_find_trim_cow_extent upon reacquisition, the data fork mapping is not refreshed beforehand. This causes xfs_bmap_trim_cow to query the refcount B-tree using stale physical block addresses, returning an inaccurate *shared value. When *shared is incorrectly reported as false, a direct I/O (directio) write proceeds using the stale data fork mapping, enabling writes to incorrect physical blocks. The fix queries the data fork mapping whenever the sequence counter changes across the ILOCK cycle (GitHub Advisory, Qualys Advisory).

Successful exploitation allows a local user with write access to an XFS filesystem to escalate privileges to root, achieving full system compromise with high confidentiality, integrity, and availability impact. The vulnerability is particularly impactful on default Red Hat Enterprise Linux (RHEL) installations and related distributions (AlmaLinux, CentOS, Rocky Linux, Amazon Linux) where XFS is the default filesystem, potentially affecting millions of systems. An attacker gaining root access can read sensitive data, modify system files, install persistent backdoors, and pivot laterally within a network (The Hacker News, BleepingComputer).

1. Reconnaissance: Identify a target Linux system running an unpatched kernel (4.11 through versions before the fix) with an XFS filesystem mounted, particularly default RHEL, AlmaLinux, CentOS, Rocky Linux, or Amazon Linux installations.
2. Obtain local access: Gain a low-privileged shell on the target system (e.g., via SSH with a standard user account, web shell, or other initial access vector).
3. Trigger the race condition: Craft a scenario involving concurrent direct I/O (O_DIRECT) writes to a file on an XFS filesystem that uses reflink/COW (Copy-on-Write) functionality. This requires the file to be part of a reflinked extent so that xfs_reflink_fill_cow_hole or xfs_reflink_fill_delalloc is invoked.
4. Exploit the stale mapping: Race the ILOCK cycle so that the data fork mapping becomes stale between the lock release and reacquisition. When *shared is incorrectly evaluated as false, the directio write proceeds to incorrect physical blocks.
5. Achieve privilege escalation: By carefully controlling which physical blocks are written to (e.g., targeting kernel data structures or SUID binaries on disk), escalate from a local user to root access (Qualys Advisory, The Hacker News).

• Logs: Kernel messages (dmesg) showing XFS errors related to refcount B-tree queries or unexpected block mapping mismatches; audit logs showing unexpected privilege escalation events (e.g., sudo or su usage by non-privileged users).
• File System: Unexpected modification timestamps on SUID binaries or kernel modules; new SUID-root files created in world-writable directories; unexpected changes to /etc/passwd or /etc/sudoers.
• Process: Unexpected root-owned processes spawned from non-root user sessions; unusual O_DIRECT write patterns to XFS-mounted filesystems visible in /proc/<pid>/fdinfo.
• Network: Outbound connections from newly spawned root processes to unknown external IPs, potentially indicating post-exploitation activity such as reverse shell establishment.

Apply the kernel patches backported to the following stable versions: 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 (GitHub Advisory). Red Hat has released errata RHSA-2026:46951, RHSA-2026:47984, RHSA-2026:47997, and RHSA-2026:48016 for affected RHEL versions (Red Hat Errata). Amazon Linux patches are available via ALAS2023-2026-2004, ALAS2KERNEL-5.4-2026-127, and ALAS2-2026-3835. As a temporary workaround until patching is complete, restrict direct I/O write access on XFS filesystems with reflinked extents, or avoid using XFS reflink features on sensitive systems. Prioritize patching on RHEL and derivative distributions where XFS is the default filesystem.

Qualys, which discovered and disclosed the vulnerability, published a detailed advisory naming it RefluXFS and highlighting its nine-year presence in the kernel (Qualys Advisory). The Hacker News and BleepingComputer both covered the flaw prominently, emphasizing its impact on default RHEL installations and the potential for millions of affected systems (The Hacker News, BleepingComputer). The vulnerability generated significant discussion on Reddit (r/AlmaLinux, r/redhat, r/linuxadmin, r/security, r/blueteamsec), Hacker News, and Mastodon/Bluesky, with community members debating the exploitability and real-world risk. SOC Prime published detection guidance, and CERT.at, GovCERT Hong Kong, and AusCERT issued advisories to their constituencies.