Search & fact check with cited sources for What is the "RefluXFS" Linux kernel vulnerability (CVE 2026 64600), how does it work, which systems are affected, and what is the remediation?

RefluXFS (CVE-2026-64600) is a high-severity local privilege escalation vulnerability in the Linux kernel's XFS filesystem, disclosed by Qualys Threat Research Unit on July 22, 2026 . It allows an unprivileged local user to gain root access by exploiting a race condition in the XFS copy-on-write (CoW) path .

---

How it works

• The flaw is a race condition in the xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc kernel helpers . These functions cycle the XFS inode lock (ILOCK) to acquire a transaction, which causes both the data fork and CoW fork mappings to become stale .
• While the CoW fork mapping is refreshed via xfs_find_trim_cow_extent, the data fork mapping is NOT refreshed before the next write . This allows a concurrent write to bypass the copy-on-write process and directly modify shared data blocks that the attacker should not be able to write to .
• An attacker with a local unprivileged account can exploit this to overwrite any file they can read — including protected system files like /etc/passwd, /etc/shadow, or SSH authorized_keys — even on systems running SELinux in Enforcing mode .
• The on-disk modification survives a system reboot .

Which systems are affected

• Kernel versions: Introduced in Linux kernel 4.11 (February 2017) by commit 3c68d44a2b49 and present in every mainline and stable kernel since then .
• Filesystem requirement: The target XFS filesystem must have the reflink feature enabled. Reflink is the default since mkfs.xfs in 2019, meaning most modern XFS volumes are affected .
• No special conditions required: No non-default kernel module, sysctl, capability, or configuration is needed .
• Confirmed affected distributions (per Qualys and CERT-EU):
  • Ubuntu 24.04 LTS
  • Amazon Linux 2023
  • RHEL 8, 9, 10
  • Oracle Linux
  • SUSE 16
  • Fedora
• Estimated impact: Over 16.4 million systems exposed .

Remediation

• Immediate kernel patching is the primary fix. Vendor-fixed kernels are now available or being backported:
  • Red Hat issued advisories (RHSA-2026:6153, RHSA-2026:4759)
  • Oracle Linux published the CVE as "Important" impact
  • The upstream kernel patch was merged on July 16, 2026
• The patch resamples the data fork mapping by querying it when the sequence counter changes across the ILOCK cycle .
• No effective workaround. There are no meaningful mitigations short of upgrading the kernel — the vulnerability requires no non-default configuration and bypasses SELinux . The only partial alternative is restricting direct-I/O write access to XFS filesystems on affected systems until patching is completed .