CVE-2026-64600: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64600, dubbed RefluXFS, is a race condition vulnerability in the Linux kernel's XFS filesystem copy-on-write (COW) mapping logic that allows local attackers to escalate privileges to root. The flaw exists in the xfs_reflink_fill_{cow_hole,delalloc} functions, which fail to refresh the data fork mapping after cycling the ILOCK, causing stale mappings to be used during direct I/O writes. It affects Linux kernel versions from 4.11 through multiple stable branches, with fixes backported to 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4. The vulnerability was disclosed on July 23, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (related to CWE-362) in the XFS reflink COW path. When xfs_reflink_fill_cow_hole or xfs_reflink_fill_delalloc cycles the ILOCK to acquire a transaction, both the data fork and COW fork mappings become stale upon reacquiring the lock. The code correctly refreshes the COW fork mapping by re-calling xfs_find_trim_cow_extent, but neglects to refresh the data fork mapping first — causing xfs_bmap_trim_cow to query the refcount btree with incorrect physical block addresses and return an inaccurate *shared value. If *shared is incorrectly set to false, a subsequent direct I/O write proceeds using the stale data fork mapping, bypassing COW protections. The fix queries the data fork mapping again if the sequence counter changes across the ILOCK cycle (GitHub Advisory, Qualys Advisory).

Successful exploitation allows a local user with low privileges to bypass XFS copy-on-write protections, potentially corrupting filesystem metadata and gaining unintended write access to shared blocks. This can lead to full local privilege escalation to root, with high impact on confidentiality, integrity, and availability of the affected system. Systems running RHEL and related distributions (AlmaLinux, CentOS, Rocky Linux, Oracle Linux, Amazon Linux) using XFS as the default filesystem are particularly exposed, with reports estimating over 16 million affected RHEL-based systems (The Hacker News, BleepingComputer, Qualys Advisory).

No confirmed working exploit has been publicly released; a GitHub repository (0xBlackash/CVE-2026-64600) was assessed as containing only educational documentation with no runnable exploit code (Feedly). Additional repositories (e.g., HORKimhab/CVE-2026-64600, Debajyoti0-0/CVE-2026-64600, vulnquest58/VQ-RefluxCore) have appeared but have not been confirmed as functional exploits. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.507–0.724%, and the vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Linux system running an XFS filesystem (common on RHEL, AlmaLinux, CentOS, Rocky Linux, Oracle Linux, Amazon Linux) with a kernel version between 4.11 and the patched releases (pre-5.15.212, pre-6.1.178, pre-6.6.145, pre-6.12.96, pre-6.18.39, pre-7.1.4).
2. Gain local access: Obtain a low-privileged local shell on the target system (e.g., via SSH with a standard user account).
3. Identify reflinked/shared XFS blocks: Locate or create files on an XFS filesystem that use reflink (copy-on-write) semantics, such as files created with cp --reflink.
4. Trigger the race condition: Initiate concurrent direct I/O write operations targeting the reflinked file while the kernel is cycling the ILOCK to grab a transaction, causing the data fork mapping to become stale before the COW path completes.
5. Exploit stale mapping: When *shared is incorrectly evaluated as false due to the stale data fork mapping, the direct I/O write bypasses COW protections and writes directly to shared physical blocks.
6. Achieve privilege escalation: By carefully controlling which shared blocks are overwritten (e.g., targeting kernel data structures or SUID binaries on the filesystem), escalate privileges to root (Qualys Advisory, The Hacker News).

• Process: Unusual processes performing high-frequency direct I/O writes (O_DIRECT) to XFS-mounted filesystems from low-privileged user accounts; unexpected privilege escalation events (e.g., a non-root process spawning a root shell).
• File System: Unexpected modifications to SUID binaries or kernel-related files on XFS partitions; files with altered ownership or permissions inconsistent with normal operations; evidence of reflinked files (cp --reflink) created by non-administrative users.
• Logs: Kernel messages in /var/log/kern.log or dmesg referencing XFS errors, refcount btree inconsistencies, or unexpected COW path failures; audit log entries (/var/log/audit/audit.log) showing setuid/setgid execution by unexpected users.
• Network: Outbound connections from newly spawned root-level processes to external IPs (indicative of post-exploitation activity following privilege escalation).

Apply the kernel patches that resample the data fork mapping after cycling ILOCK. Fixed versions include: 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 (GitHub Advisory). Red Hat has issued errata RHSA-2026:46951, RHSA-2026:47984, RHSA-2026:47997, and RHSA-2026:48016 for affected RHEL versions (Red Hat Errata). Amazon Linux patches are available via ALAS2023-2026-2004, ALAS2KERNEL-5.4-2026-127, and ALAS2-2026-3835. As a temporary workaround where immediate patching is not possible, restrict direct I/O write access to XFS filesystems and limit use of reflink-capable operations by untrusted users (Qualys Advisory).

Qualys, which discovered and disclosed the vulnerability, published a detailed advisory naming it RefluXFS and highlighting its nine-year presence in the kernel (Qualys Advisory). The Hacker News and BleepingComputer both covered the flaw prominently, emphasizing its impact on default RHEL installations and the estimated 16+ million exposed systems (The Hacker News, BleepingComputer). Community discussion on Reddit, Hacker News, and Mastodon was active, with security researchers noting the significance of an AI-assisted discovery of a nearly decade-old kernel bug. The oss-security mailing list hosted multiple threads discussing technical details and exploit feasibility (oss-sec). SOC Prime published detection guidance, and CERT.at and GovCERT Hong Kong issued alerts to their constituencies.