Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

Key Points:

• A critical Linux kernel vulnerability named RefluXFS (CVE-2026-64600) allows unprivileged local users to overwrite root-owned files on XFS filesystems with reflink enabled, enabling persistent root access without altering file metadata.
• The flaw affects Linux kernels from version 4.11 onward if the XFS filesystem was created with reflink=1, and the attacker-writable directory and target file reside on the same filesystem; default installations of Red Hat Enterprise Linux, Fedora Server, Amazon Linux, and derivatives are notably exposed.
• The exploit leverages a race condition during copy-on-write operations in XFS reflinks, causing stale block mappings that permit unauthorized direct writes to protected files, surviving reboots and bypassing typical security mechanisms like SELinux and kernel lockdown.
• The vulnerability was discovered and exploited with the help of an AI model mimicking Dirty COW-like attacks; patches were merged on July 16, 2026, and Linux vendors have released backported kernel updates, with users urged to patch and reboot promptly as no temporary mitigation exists.
• Debian, Ubuntu, SLES, and openSUSE are generally unaffected unless XFS with reflink was manually enabled; users can check exposure by verifying reflink=1 on their filesystems and should prioritize patching multi-tenant and untrusted code environments immediately.