Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root in Default RHEL Installation

RefluXFSthe new one Linux kernel error was revealed on July 22 and is tracked as CVE-2026-64600allows an unprivileged local user to overwrite root-managed files in the XFS file system and gain persistent root access.

Qualys said that default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux could meet the criteria for an exploit.

The company has proven to be competitive /etc/passwd and setuid-root binaries. It writes over the block layer. It survives reboots and leaves the target’s identity, permissions, timestamps, and setuid bit untouched, so a modified setuid-root binary still works as root.

The fix was patched on July 16, and Linux vendors have started shipping backported kernels. Patch tracks a bug in Linux 4.11 in 2017: a Fixes: naming tag 3c68d44a2b49 and a stable backport application marked # v4.11.

Revealed

Exploitation requires three conditions:

• The system uses Linux 4.11 or later without RefluXFS configuration.
• The XFS file system is built with reflink=1.
• A readable target and an attacker’s writable directory on the same XFS file system.

Qualys said the patches exposed and the systems are multi-tenant first, meaning any reflink-enabled XFS host where untrusted code can run locally, be it through a shell, a CI job, or a vulnerable service.

The advisory lists the default installations that may meet those criteria: Red Hat Enterprise Linux, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux and CloudLinux 8, 9 and 10, Fedora Server 31 and later, Amazon Linux 2023, and Amazon Linux 2 images from December 2022 onwards. RHEL 7 file systems are not affected because they predate XFS reflink support.

Debian, Ubuntu, SLES, and openSUSE generally do not use XFS for the root file system by default. They are only displayed if the administrator selected XFS with reflink enabled during installation.

Check the root file system:

xfs_info / | grep reflink=

reflink=1 means that the second condition is met. Run the same check on any other mounted XFS volume where the protected file and the attacker’s writable directory share a file system.

Stale Mapping

An attacker compiles a root-managed file into a scratch file with FICLONEwhich requires read-only access to the source, and runs concurrently O_DIRECT write against the clone. XFS reflinks use copy-on-write, so both files initially refer to the same blocks on the physical disk.

The kernel reads the data fork map under the inode lock and allocates it xfs_reflink_fill_cow_hole()which are lock cycles to maintain transaction space.

A second writer can complete a copy-on-write operation during that gap and rearrange the merged file into a new block. If the original writer reacquires the lock, it renews the copy-on-write fork but continues to use the old data fork map.

The upstream patch describes the failure clearly: “draw timed out when reacquiring ILOCK.”

That old address now points to a block that only holds the first protected file. XFS recognizes the block as unallocated and allows direct writes, so the data intended for the attacker’s actor remains on the target.

It’s a test error and use a lock cycle. The question of shared status itself is a good one; it asks for the address of the block taken before the lock was released.

Hacker News has discovered that the episode involves two assistants, xfs_reflink_fill_cow_hole() again xfs_reflink_fill_delalloc(). The second carries the same lock cycle pattern and does not appear in the Qualys hint. In both cases, corrections are made ip->i_df.if_seq before the lock is released and re-reads the data fork as well xfs_bmapi_read() if the counter is moving.

Direct I/O bypasses the page cache and has no commit hook, so writes fall to disk. Because it bypasses the target inode entirely, the metadata doesn’t change, and the researchers say their test didn’t produce a kernel warning or log entry.

In the testing machine, the race is usually won by less than ten seconds. The published demo strips the root password from the default RHEL 10.2 box.

Qualys said the AI ​​model detected an error. The company pointed to Claude Mythos Preview, Anthropic’s limited access-to-border model, to the kernel and, according to its technical advisory, “requested that it detect vulnerabilities similar to Dirty COW.”

The model found the race, wrote the working root, and wrote the advice. The researchers then reproduced it on a stock Fedora Server 44, tested the model’s assumptions, and coordinated upstream and downstream information disclosure.

It’s not the group’s first kernel bug this year. Qualys has been getting a lot of this. A day ago, it revealed the snap-confine bug in Ubuntu Desktop, CVE-2026-8933where two races allow the local user to get root on the default installation. In May it found a nine-year-old bug in the kernel’s ptrace check.

Patch, Then Reboot

Red Hat has issued critical kernel advisories for all affected RHEL 8, 9, and 10 streams. The bug first arrived on July 14, eight days before the combined releases: RHSA-2026:39179 and RHSA-2026:39180 for RHEL 8 and RHSA-2026:39494 for RHEL 10, with extended support and SAP distribution following July 17.

The spread is specific to the stream, so make sure there is advice for your specific release. Anyone who used those bugs was screwed before RefluXFS had a name. Check your expiration dates before you consider exposure.

The vendor’s bug tracker lists the error under the heading “kernel: XFS data corruption using reflink.” The entry was automatically imported on July 10 and initially described the problem as possible data corruption in file reanalysis.

As of July 23rd, the Debian tracker has listed a fix for trixie-security as a kernel. 6.12.96-1 and unstable as 7.1.4-1. The basis of Trixie’s kernel 6.12.94-1 and forky 7.1.3-1 they were still marked as vulnerable, as were bookworm and bullseye, including their security branches.

There is no mount option or sysctl that disables XFS reflink after the filesystem is created, and Qualys said there is no practical mitigation or temporary configuration change available. SELinux in Enforcement mode, seccomp, kernel lockdown, and container restrictions all failed to stop it in the company’s tests. Memory protections such as KASLR and SMEP are never used: this is block-layer writing, not memory corruption.

One visible limit is not one. The race only explodes when the target’s block becomes unshared, so a file that the controller has recopied cannot be hit. The advisor states that an unprivileged user can reset that state by booting chshand that the setuid-root binaries will probably never be recombined in the first place.

Qualys has not published independent exploit code. Red Hat’s tracker posted a public proof view on July 22, pointing to tips listed in oss-security, which lays out the race and steps of the full exploit. None of the vendors tracking this bug had reported any exploits in the wild at the time of writing.

Hacker News has reached out to Red Hat for comment about its evaluation of the impact of the bug and to Qualys for more details on the findings, and will update this story with any response.

Installing a package does not replace the kernel that is already running in memory. Install the vendor update, reboot the system, and make sure it’s running a stable kernel.