0fjno 
TL;DR
Qualys disclosed RefluXFS on July 22, 2026. Tracked as CVE-2026-64600, it is a Linux kernel XFS privilege escalation to root. Qualys estimates the flaw potentially affects more than 16.4 million systems worldwide.
Why it matters
XFS is the default root filesystem on Red Hat Enterprise Linux and its many clones. A local bug there reaches an enormous install base. Qualys calls the issue an emergency priority.
The exposure is wide. Affected platforms include RHEL, Oracle Linux, Amazon Linux, and Fedora Server. Any ordinary local user can trigger this XFS privilege escalation to root.
Standard hardening does not help
Usual defenses miss this flaw. The write lands at the filesystem allocation layer, below memory protections like KASLR, SMEP and SMAP. Per Qualys, “SELinux doesn’t block the affected path in testing”, and container limits fall short too.
How the attack works
The bug is a race condition in the XFS copy-on-write path. An unprivileged user reflink-clones a protected file, such as /etc/passwd or a SUID-root binary, into a scratch file.
The attacker then races two direct-I/O writes on that clone. The kernel drops its inode lock while waiting for log space. In that window, a stale block address slips through a reference-count check.
As a result, one write lands on the original file’s physical block. The change hits the disk directly. It survives reboot, produces no kernel log, and leaves the target’s inode untouched, so a SUID binary keeps its SUID bit.
Affected versions
Qualys traces the flaw to kernel 4.11, released in 2017. Every mainline and stable kernel since then carries it. You are exposed only if your XFS filesystem uses reflink, which has been the mkfs.xfs default since 2019.
Debian, Ubuntu and SUSE do not use XFS by default. They become exposed only if an admin chose XFS with reflink at install time.
Exploitation status
No in-the-wild exploitation has been confirmed. A working proof-of-concept exists, but Qualys has not released the exploit code publicly. The Qualys advisory includes a proof-of-concept video demonstration.
Patch and mitigation
Patch the kernel now, then reboot to apply it. The fix merged into the Linux tree on July 16, 2026, and distributions are backporting it. Qualys notes there are no reliable temporary mitigations, so updating is the only real fix.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
