Qualys discloses RefluXFS Linux flaw giving local root on RHEL
This digest was compiled by AI from multiple sources — links to the originals are below.
Qualys disclosed a Linux kernel flaw, CVE-2026-64600, on July 22 that lets unprivileged local users overwrite root-owned files on XFS filesystems. The vulnerability affects default Red Hat Enterprise Linux installations and derivatives, granting persistent root access. The fix was merged July 16, and vendors have begun shipping backported kernels.
The Vulnerability
The flaw, named RefluXFS and tracked as CVE-2026-64600, allows an unprivileged local user to overwrite root-owned files on an XFS filesystem. Qualys demonstrated a race condition against /etc/passwd and setuid-root binaries. The overwrite occurs at the block layer, survives reboot, and preserves ownership, permissions, timestamps, and the setuid bit, so a modified setuid-root binary still runs as root.
Affected Systems
Exploitation requires Linux 4.11 or later without the fix, an XFS filesystem created with reflink=1, and a readable target file on the same filesystem as an attacker-writable directory. Default installations of Red Hat Enterprise Linux, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux 8/9/10, Fedora Server 31+, and Amazon Linux 2023 are affected. RHEL 7 is not vulnerable. Debian, Ubuntu, SLES, and openSUSE are only exposed if XFS with reflink was manually selected.
The Stale Mapping
The attack clones a root-owned file via FICLONE, requiring only read access, then races concurrent O_DIRECT writes against the clone. XFS reflinks use copy-on-write, so both files initially share physical blocks. The kernel reads the data-fork mapping under the inode lock, but a gap during transaction reservation allows a second writer to complete copy-on-write and remap the clone. The first writer then uses a stale mapping pointing to blocks owned only by the original file.
What's Next
Linux vendors are shipping backported kernels, and administrators should patch exposed systems, especially multi-tenant ones. It remains unclear how many unpatched systems remain vulnerable in production environments.
2 sources
Qualys discloses RefluXFS Linux flaw giving local root on RHEL
