答案已發布7 小時前Last edited 6 小時前22 個來源

RefluXFS Linux 核心漏洞 CVE-2026-64600 深度解析

RefluXFS (CVE 2026 64600) 是 Linux 核心 XFS 檔案系統的高嚴重性本地權限提升漏洞，由 Qualys Threat Research Unit 於 2026 年 7 月 22 日揭露 [4]。未授權的本地使用者可利用 XFS 寫入時複製（CoW）路徑中的競爭條件，取得 root 權限 [2][4][9]。

使用 Studio Global AI 搜尋並查證事實瀏覽更多熱門頁面

Search & fact check with cited sources for What is the "RefluXFS" Linux kernel vulnerability (CVE 2026 64600), how does it work, which systeAI-generated editorial hero image for Search & fact check with cited sources for What is the "RefluXFS" Linux kernel vulnerability (CVE 2026 64600), how does it work, which syste.
AI 提示詞
Create a landscape editorial hero image for this Studio Global article: Search & fact check with cited sources for What is the "RefluXFS" Linux kernel vulnerability (CVE 2026 64600), how does it work, which syste. Article summary: RefluXFS (CVE 2026 64600) is a high severity local privilege escalation vulnerability in the Linux kernel's XFS filesystem, disclosed by Qualys Threat Research Unit on July 22, 2026 [4].. Topic tags: general web, prompt engineering, ai, workflow, code. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickba
openai.com

RefluXFS (CVE-2026-64600) 是一個高嚴重性的 Linux 核心 XFS 檔案系統本地權限提升漏洞，由 Qualys Threat Research Unit 於 2026 年 7 月 22 日公開揭露。此漏洞允許未授權的本地使用者透過利用 XFS 寫入時複製（Copy-on-Write, CoW）路徑中的競爭條件，取得 root 權限。

漏洞運作原理

漏洞的根源是 競爭條件，存在於 xfs_reflink_fill_cow_hole 和 xfs_reflink_fill_delalloc 這兩個核心輔助函式中。這些函式為了獲取交易，會循環使用 XFS inode lock (ILOCK)，這個過程會導致資料分支和 CoW 分支的映射資訊過時。
雖然 CoW 分支的映射會透過 xfs_find_trim_cow_extent 更新，但在下一次寫入發生前，。這使得並行寫入可以繞過寫入時複製機制，直接修改攻擊者原本無權寫入的共享資料區塊。

Studio Global AI

Search, cite, and publish your own answer

Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.

使用 Studio Global AI 搜尋並查證事實

大家也會問