A critical vulnerability has been discovered in Linux systems that allows attackers to gain root privileges. Dubbed RefluXFS by Qualys’ Threat Research Unit (TRU), this flaw affects millions of systems running major enterprise Linux distributions, including Red Hat Enterprise Linux, Oracle Linux, and Amazon Linux.
RefluXFS is a nine-year-old race condition vulnerability in the Linux kernel’s XFS filesystem that has been hiding in plain sight. It allows attackers to overwrite protected files and gain root privileges by exploiting a flaw in the kernel’s copy-on-write allocation path. The attack works by reflink-cloning a target file into a scratch file owned by the attacker, then racing concurrent O_DIRECT writes on that scratch file. A lock-drop window in the kernel lets one of those writes land in the physical block that still backs the original file, making the change directly on disk.
The impact is significant: RefluXFS has been present in every mainline and stable kernel since February 2017, when it was introduced in kernel version 4.11. It affects systems with an XFS filesystem that has reflink enabled (a default configuration on many enterprise Linux distributions), running Linux kernel v4.11 or later, with a directory writable by an unprivileged local user.
Qualys estimates that RefluXFS potentially affects more than 16.4 million systems based on analysis using its Cybersecurity Asset Management software. The list of impacted Linux distros includes major players like Red Hat Enterprise Linux (RHEL), Oracle Linux, Amazon Linux, and Fedora. Other distributions such as CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux are also affected.
The good news is that a patch has been released by kernel maintainers, and immediate kernel patching is recommended to neutralize this vulnerability. However, exploitation succeeds consistently under standard hardening settings, and the on-disk modification survives a system reboot. Organizations should prioritize patching exposed and multi-tenant systems and ensure a reboot to verify the update.
This latest discovery highlights the ongoing battle between security researchers and attackers. RefluXFS is the latest in a long series of Linux privilege escalation vulnerabilities disclosed since the start of the year, including CIFSwitch, PinTheft, Copy Fail, Dirty Frag, Fragnesia, Pack2TheRoot, and DirtyDecrypt/DirtyCBC.
To stay ahead of these threats, security teams must be proactive in testing their systems for vulnerabilities. This includes regularly updating software, using intrusion detection and prevention systems (IDPS), and implementing robust incident response plans. By taking a layered approach to security, organizations can reduce the risk of successful attacks and minimize the damage when breaches do occur.
In conclusion, RefluXFS is a critical vulnerability that requires immediate attention from Linux system administrators. The patch has been released, but it’s essential to take proactive steps to ensure that your systems are secure. By prioritizing patching and regularly testing for vulnerabilities, you can reduce the risk of successful attacks and protect your organization’s sensitive data.
Source: Bleeping Computer — 2026-07-23