CVE-2026-64600: 
Linux Kernel Analisi e mitigazione delle vulnerabilità

CVE-2026-64600, dubbed RefluxFS, is a race condition vulnerability in the Linux kernel's XFS filesystem subsystem that allows local attackers to escalate privileges to root. The flaw was introduced with commit 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 (kernel 4.11) and has persisted for approximately nine years. It affects Linux kernel versions from 4.11 up to (but not including) the patched releases: 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4. The vulnerability was publicly disclosed on July 23, 2026, with an EPSS score of 0.0 and a CVSS category estimate of Medium, though media coverage highlights its potential for root-level privilege escalation on default RHEL and related distributions (GitHub Advisory, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (related to CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in the XFS reflink helpers xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc. Both functions are presented with an inode, a data fork mapping, and a CoW (copy-on-write) fork mapping, but they cycle the ILOCK to acquire a transaction — causing both mappings to become stale upon ILOCK reacquisition. While the CoW fork mapping is refreshed via xfs_find_trim_cow_extent, the data fork mapping is not refreshed beforehand, causing xfs_bmap_trim_cow to query the refcount B-tree using stale physical block addresses and return an inaccurate *shared value. When *shared is incorrectly reported as false, a direct I/O (directio) write proceeds using the stale data fork mapping, enabling writes to incorrect physical blocks. The fix resamples the data fork mapping by re-querying it whenever the sequence counter changes across the ILOCK cycle (GitHub Advisory, oss-sec).

A local user with write access to an XFS filesystem can trigger this vulnerability through directio write operations, causing writes to be performed to incorrect physical blocks or with incorrect refcount information. The primary consequence is local privilege escalation to root, particularly on default RHEL, AlmaLinux, CentOS, Rocky Linux, and Amazon Linux installations that use XFS as the default filesystem. Secondary impacts include filesystem data corruption or data loss, as writes may target wrong physical blocks, potentially affecting other users' data or critical system files (Feedly, The Hacker News, BleepingComputer).

Apply the kernel patches that resample the data fork mapping by re-querying it when the sequence counter changes across the ILOCK cycle. Fixed versions are: 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 (upstream). The corresponding upstream fix commits are e705d81a7193dd19e69b8e2bad4696d78a4ea075, 206c09b04dc5469c7ff14d8aceff2d47c88078d9, 44f891bc088958399eec27f7604928694aa35581, and 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 (GitHub Advisory). As a temporary workaround until patching is completed, restrict direct I/O write access on affected XFS filesystems or limit local user access to sensitive systems. RHEL, AlmaLinux, CentOS, Rocky Linux, and Amazon Linux users should prioritize applying vendor-provided kernel updates (Feedly).

The vulnerability attracted significant media attention under the name "RefluxFS," with coverage from The Hacker News, BleepingComputer, CyberSecurityNews, and multiple regional SecurityBrief outlets highlighting its nine-year lifespan and potential impact on default RHEL installations (The Hacker News, BleepingComputer). Community discussion on Reddit (r/AlmaLinux, r/redhat, r/linuxadmin, r/Fedora, r/security) and Hacker News was active, with threads analyzing the XFS race condition and its implications for enterprise Linux deployments. The oss-security mailing list hosted technical disclosure threads (oss-sec). Some coverage characterized the flaw as allowing root access on "1.64M" systems, though no confirmed exploitation has been reported.