RefluXFS (CVE-2026-64600): The Linux Kernel XFS Race Condition Affecting 16.4M Systems

RefluXFS (CVE-2026-64600) is a high-severity local privilege escalation vulnerability in the Linux kernel's XFS filesystem. Discovered and disclosed by the Qualys Threat Research Unit on July 22, 2026, it allows an unprivileged local user to gain root access by exploiting a race condition in the XFS copy-on-write (CoW) path . The vulnerability affects an estimated 16.4 million systems globally and requires no special capabilities or non-default configurations to exploit .

How RefluXFS Works

The flaw is a race condition in two kernel helper functions: xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc . When these functions cycle the XFS inode lock (ILOCK) to acquire a transaction, the mappings for both the data fork and the CoW fork can become stale . Although the CoW fork mapping is refreshed using xfs_find_trim_cow_extent, the data fork mapping is not refreshed before the next write operation . This oversight means a concurrent write can bypass the copy-on-write process entirely and directly modify shared data blocks that the attacker should not be able to write to .

An attacker with a local unprivileged account can exploit this to overwrite any file they can read, including protected system files like /etc/passwd, /etc/shadow, or SSH authorized_keys. The exploit works even on systems running SELinux in Enforcing mode . Critically, the on-disk modification survives a system reboot .

Affected Systems and Scope

The vulnerability was introduced in Linux kernel version 4.11 (February 2017) by commit 3c68d44a2b49 and is present in every mainline and stable kernel since . It requires that the target XFS filesystem have the reflink feature enabled, which has been the default for mkfs.xfs since 2019, meaning most modern XFS volumes are affected .

Confirmed Affected Distributions

Per Qualys and CERT-EU, the following distributions have been directly verified as vulnerable :

• Ubuntu 24.04 LTS - kernel 6.17.0-1007-aws
• Amazon Linux 2023 - kernel 6.18.8-9.213.amzn2023
• RHEL 8, 9, 10
• Oracle Linux
• SUSE 16 - kernel 6.12.0-160000.9-default
• Fedora

Other distributions that ship kernels in the affected range are implicitly vulnerable, including Debian, Arch Linux, Rocky Linux, AlmaLinux, and embedded Linux builds .

Remediation: Patching Is the Only Fix

Immediate kernel patching is the sole reliable remediation. There are no meaningful workarounds — the vulnerability requires no non-default configuration, cannot be blocked by SELinux, and does not produce kernel log output during exploitation . The only partial mitigation is restricting direct-I/O write access to XFS filesystems on affected systems until patching is complete .

The upstream kernel patch was merged on July 16, 2026 (commit 2f4acd0: "xfs: resample the data fork mapping after cycling ILOCK") . The fix resamples the data fork mapping by querying it when the sequence counter changes across the ILOCK cycle, ensuring that stale mappings are not used for the next write .

Vendor Patches

• Red Hat issued advisories RHSA-2026:6153 and RHSA-2026:4759
• Oracle Linux rated the CVE as "Important" impact and published corresponding fixed kernels
• CIQ (Rocky Linux) released patched kernels for versions 8, 9, and 10

Organizations using affected Linux systems should apply vendor security updates immediately and reboot to ensure the patched kernel is active . Because the vulnerability affects such a large installed base and is reliably exploitable without special privileges, it represents a critical risk to any multitenant or shared-user Linux environment.