A new Linux vulnerability has been discovered that allows attackers to gain root privileges on systems with an XFS filesystem. Dubbed RefluXFS by the Qualys Threat Research Unit (TRU), this security flaw affects millions of Linux users worldwide and poses a significant threat to system integrity.
The vulnerability, tracked as CVE-2026-64600, has been present in the Linux kernel since February 2017 and was only recently discovered. It allows attackers to overwrite protected files and gain root privileges by exploiting a race condition in the XFS filesystem’s reflink feature, which is enabled by default on many enterprise Linux distributions.
Reflink is a way for Linux systems to share file metadata without duplicating the actual file data. However, when an attacker uses reflink to create a copy of a sensitive file, they can potentially overwrite the original file if another process writes to it at the same time. This can be done without triggering any kernel log output or leaving behind any evidence on disk.
The impact of RefluXFS is significant, with Qualys estimating that over 16.4 million systems may be affected. The list of impacted Linux distributions includes major enterprise distros like Red Hat Enterprise Linux (RHEL), Oracle Linux, Amazon Linux, and Fedora. Additionally, CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux are also vulnerable.
Qualys discovered the vulnerability through a research initiative with Anthropic, which used an AI model to identify potential vulnerabilities in the XFS filesystem. The researchers then manually verified the findings and developed a functional proof-of-concept exploit.
The good news is that vendor-fixed kernels are now available for download, and backporting of these patches has begun on enterprise distributions. However, organizations should prioritize patching their systems as soon as possible to prevent exploitation. Unfortunately, there are no reliable or practical mitigations available at this time.
This latest Linux vulnerability highlights the importance of staying up-to-date with security patches and monitoring for signs of exploitation. It’s a sobering reminder that even the most seemingly secure systems can be vulnerable to attack if not properly maintained.
For users affected by RefluXFS, immediate action is required to protect their systems. We recommend testing every layer of your system before attackers do – use breach and attack simulation tests to ensure your SIEM and EDR rules are effective in detecting potential threats. Don’t wait for an attack to happen; stay proactive and secure your environment today.
Source: Bleeping Computer — 2026-07-23