Cybersecurity Announcement: Linux Kernel Privilege Escalation to Root Vulnerability - RefluXFS (CVE-2026-64600)
This document is the cybersecurity announcement for the RefluXFS Linux LPE vulnerability.
About the Event
July 22, 2026 - Qualys Threat Research Unit published a blog about RefluXFS. It is a Linux LPE vulnerability caused by a race condition in the XFS filesystem's copy-on-write path.
Actions to Consider
RefluXFS allows an unprivileged local user to overwrite the on-disk contents of any readable file on a reflink-enabled XFS volume.
The RefluXFS vulnerability affects systems meeting all three of the following criteria:
At this time, the upstream patch has been submitted and distribution vendors are working on backported patches. Since this vulnerability operates at the filesystem allocation layer, standard detection and hardening practices will not work here. Cybersecurity will update this announcement when patches become available.
The RefluXFS vulnerability affects systems meeting all three of the following criteria:
- Kernel Version: Running Linux kernel v4.11 or later (2017) without the specific security patch.
- Filesystem Configuration: Utilizing an XFS filesystem with reflink=1 in its superblock.
- File Structure: The filesystem must contain both a high-value target (a root-owned configuration file or SUID-root binary) and a directory writable by an unprivileged local user.
Affected distributions
- RHEL 8, 9, and 10
- CentOS Stream 8, 9, and 10
- Oracle Linux 8, 9, and 10
- Rocky and AlmaLinux 8, 9, 10
- CloudLinux 8, 9, and 10
- Amazon Linux 2023 and Amazon Linux 2 AMIs from December 2022 onward
- Fedora Server 31+
- Debian, Ubuntu, and SUSE do not use XFS by default, but become exposed if an administrator manually selects XFS during installation, and reflink=1.
At this time, the upstream patch has been submitted and distribution vendors are working on backported patches. Since this vulnerability operates at the filesystem allocation layer, standard detection and hardening practices will not work here. Cybersecurity will update this announcement when patches become available.
Event Impact
Any local unprivileged user would be able to obtain root-level access resulting in a full system takeover. There is no public Proof-of-Concept code available. However, Qualys released a demo video of a working PoC. There are no reports of it being exploited in the wild.