RefluXFS: A Critical Linux Kernel Flaw Threatens Root Access on XFS Filesystems

A newly disclosed Linux kernel vulnerability, dubbed RefluXFS and tracked as CVE-2026-64600, presents a significant security risk by allowing unprivileged local users to overwrite root-owned files on XFS filesystems, ultimately enabling persistent root access. The flaw, publicly disclosed on July 22, 2026, exploits a subtle race condition within the XFS filesystem’s reflink functionality, a feature that enables efficient file copying through data deduplication. This vulnerability could have far-reaching implications for systems utilizing XFS, particularly those with default configurations from major Linux distributions.

The severity of RefluXFS lies in its ability to bypass fundamental file ownership and permission checks. Security researchers at Qualys, who identified and reported the flaw, demonstrated how an attacker could leverage this vulnerability to overwrite critical system files such as /etc/passwd, which controls user account information, or setuid-root binaries, executables that are granted elevated privileges when run. Crucially, the overwrite occurs at the block layer, meaning the changes persist across system reboots. The exploit leaves the target file’s ownership, permissions, timestamps, and even the setuid bit intact, ensuring that a modified setuid-root binary will execute with root privileges, thereby granting the attacker full control over the compromised system.

Chronology of the RefluXFS Vulnerability

The discovery and disclosure of RefluXFS followed a typical cybersecurity lifecycle:

• Inception (circa 2017): The underlying bug, a race condition related to handling file mappings during copy-on-write operations in XFS reflinks, was introduced into the Linux kernel with the merge of Linux 4.11. The Fixes: tag in the upstream patch, 3c68d44a2b49, and a stable backport request marked # v4.11 pinpoint this origin. For nearly a decade, this potential vulnerability lay dormant, unnoticed within the vast codebase.
• Discovery (Early 2026): Qualys’s AI model, Claude Mythos Preview, a restricted-access frontier model from Anthropic, was tasked with finding vulnerabilities similar to the infamous Dirty COW exploit. The AI model, trained on vast amounts of code and vulnerability data, identified the specific race condition within the XFS reflink implementation.
• Exploit Development (Early 2026): Not only did the AI model locate the flaw, but it also reportedly generated a working root exploit and drafted a technical advisory detailing the vulnerability. This marks a significant advancement in AI-assisted security research, showcasing its capability to move beyond pattern recognition to active exploit generation.
• Verification and Reproduction (Mid-2026): Security researchers at Qualys reproduced the AI’s findings on a standard Fedora Server 44 installation, validating the exploit’s effectiveness and understanding the underlying mechanisms. This human oversight is crucial for confirming AI-generated results and ensuring the accuracy of the findings.
• Coordination and Disclosure (July 2026): Qualys coordinated its disclosure with Linux vendors, adhering to responsible disclosure practices. The fix was merged into the Linux kernel on July 16, 2026, a full eight days before the public announcement. Linux vendors then began the process of backporting the patch to their stable kernel releases. The public disclosure occurred on July 22, 2026, with the assignment of the CVE identifier CVE-2026-64600.
• Vendor Patching (July 2026 onwards): Following the disclosure, vendors like Red Hat promptly issued kernel advisories and began distributing patched kernels to their users.

Understanding the Technical Underpinnings: The Stale Mapping

The RefluXFS vulnerability hinges on a sophisticated race condition within the XFS filesystem’s reflink implementation. When a user initiates a file copy using FICLONE, XFS leverages copy-on-write (COW) semantics. Initially, both the original and the cloned file point to the same physical disk blocks, saving storage space and improving copy performance.

The exploitation process involves an attacker cloning a root-owned file into a temporary "scratch" file, a maneuver requiring only read access to the original. The critical phase occurs when the attacker performs concurrent O_DIRECT writes against this cloned file. O_DIRECT bypasses the system’s page cache, allowing for direct disk I/O operations.

The vulnerability arises during the interaction between the kernel’s inode lock and the reflink COW process. The kernel reads the data-fork mapping of the file under the inode lock and passes it to the xfs_reflink_fill_cow_hole() function. This function, in turn, cycles the inode lock to reserve transaction space within the filesystem.

It is during this brief window, between the release and reacquisition of the inode lock, that the race condition can be exploited. A second writer, initiated by the attacker, can complete the COW operation. This operation remaps the cloned file to a new set of disk blocks, effectively creating a separate copy of the data.

However, when the first writer (the one initiated by the kernel’s reflink process) reacquires the inode lock, it refreshes the COW fork but continues to operate with the stale data-fork mapping that was captured before the lock was released. This stale address now points to a block that is exclusively owned by the original, protected file.

XFS, perceiving this block as unshared due to the stale mapping, permits the direct write operation. Consequently, the data intended for the attacker’s cloned file is inadvertently written to the original, root-owned file. This "check-then-use" error, occurring across a lock cycle, allows the attacker to overwrite the target file’s content without altering its metadata. The direct I/O bypasses standard revalidation hooks, meaning the system may not detect the unauthorized write, and researchers noted no kernel warnings or log entries in their testing. The entire race typically concludes in under ten seconds.

The upstream patch, described as 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 on GitHub, explicitly addresses this by snapshotting ip->i_df.if_seq (an internal inode sequence counter) before the lock is dropped. Upon reacquiring the lock, the patch re-reads the data fork using xfs_bmapi_read() and checks if the sequence counter has changed. If it has, indicating a modification during the lock cycle, the operation is retried with the updated mapping, preventing the use of stale addresses. The patch also affects xfs_reflink_fill_delalloc(), another helper function exhibiting a similar lock-cycle pattern.

Who is Exposed? Default Installations at Risk

Qualys has identified several default Linux installations that are susceptible to exploitation if they meet specific conditions:

• Red Hat Enterprise Linux (RHEL) and its derivatives: This includes CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, and CloudLinux versions 8, 9, and 10. These distributions often utilize XFS as their default root filesystem, and older versions may have had reflink support enabled by default.
• Fedora Server: Versions 31 and later are potentially exposed.
• Amazon Linux: Amazon Linux 2023 and Amazon Linux 2 images released from December 2022 onwards are also at risk.

It is important to note that RHEL 7 filesystems are not affected because they predate the widespread adoption and implementation of XFS reflink support.

While Debian, Ubuntu, SUSE Linux Enterprise Server (SLES), and openSUSE generally do not use XFS as their default root filesystem, they are not entirely immune. Administrators who have explicitly chosen to configure XFS with reflink enabled during the installation of these distributions would be exposed.

The exploitation requires three conditions to be met simultaneously. While the original article did not explicitly list all three, the context implies:

1. Use of XFS filesystem: The vulnerability is specific to the XFS filesystem.
2. Reflink functionality enabled: The XFS filesystem must have reflink support enabled. This is often indicated by the reflink=1 mount option, which can be checked using the command xfs_info / | grep reflink=.
3. Local unprivileged access: An attacker must have local access to the system with unprivileged user credentials, allowing them to execute code. This could be through a compromised service, a user account with limited privileges, or even within a CI/CD pipeline.

Qualys strongly advises prioritizing patching for exposed and multi-tenant systems, particularly any reflink-enabled XFS host where untrusted code can be executed locally.

Mitigation and Patching Efforts

The immediate and most effective mitigation for RefluXFS is to apply the patched kernel. The fix was merged upstream on July 16, 2026, and Linux vendors have been actively shipping backported kernels to address the vulnerability.

• Red Hat: Has released "Important"-rated kernel advisories for affected RHEL 8, 9, and 10 streams. These errata began rolling out on July 14, 2026, prior to the coordinated public disclosure. Specific advisories include RHSA-2026:39179 and RHSA-2026:39180 for RHEL 8, and RHSA-2026:39494 for RHEL 10, with extended-support and SAP streams also receiving updates. Users are urged to confirm that an advisory exists for their specific release and to apply the patches promptly.
• Debian: As of July 23, 2026, Debian’s security tracker indicated the fix in trixie-security with kernel version 6.12.96-1 and in unstable with 7.1.4-1. Older stable releases like bookworm and bullseye, including their security branches, were still marked as vulnerable.
• Other Distributions: Vendors like Ubuntu, SLES, and openSUSE are expected to incorporate the fix into their respective kernel updates. Users of these distributions should monitor their vendor’s security advisories.

It is crucial to understand that simply installing a package does not immediately update the running kernel in memory. After applying the vendor update, a system reboot is mandatory to ensure the patched kernel is loaded and active. Users should verify that their systems are running the fixed kernel version post-reboot.

Unfortunately, there are no readily available mount options or sysctl parameters that can disable XFS reflinks after a filesystem has been created. This means that once reflink functionality is enabled on an XFS filesystem, there are no simple configuration changes to mitigate this specific vulnerability without patching the kernel. Security measures such as SELinux in Enforcing mode, seccomp, kernel lockdown, and container boundaries have been tested and found ineffective against this exploit, as it targets the block layer and bypasses memory protection mechanisms.

Limitations and Exploitation Landscape

While RefluXFS is a severe vulnerability, there are certain inherent limitations that might restrict its widespread exploitation in some scenarios. The race condition only triggers if the target block on the original file is initially "unshared." This means that files that have already undergone a reflink copy operation by an administrator cannot be directly targeted by this exploit. Furthermore, setuid-root binaries, which are critical system components, are generally not reflinked by administrators, making them more susceptible to this attack vector.

Qualys has not published standalone exploit code, adhering to responsible disclosure practices. However, Red Hat’s bug tracker logged a public proof-of-concept on July 22, 2026, referencing the detailed explanation of the race and exploitation steps provided on the oss-security mailing list. As of the time of reporting, none of the vendors tracking the flaw had reported any instances of exploitation in the wild.

Broader Implications and AI’s Role in Vulnerability Discovery

The discovery of RefluXFS by an AI model highlights a paradigm shift in cybersecurity. The ability of AI to not only identify complex vulnerabilities but also to generate functional exploits and draft technical documentation is a testament to its growing sophistication. This development presents both opportunities and challenges. On one hand, AI can significantly accelerate the process of finding and fixing bugs, potentially leading to a more secure digital landscape. On the other hand, it raises concerns about the potential for malicious actors to leverage similar AI capabilities for more efficient and widespread attacks.

This is not the first time Qualys has uncovered aged kernel bugs this year. Their proactive research has also led to the disclosure of a snap-confine flaw in Ubuntu Desktop (CVE-2026-8933), which allowed local users to gain root privileges, and a nine-year-old bug in the kernel’s ptrace checks. The consistent discovery of such long-standing vulnerabilities underscores the ongoing challenge of maintaining the security of complex software systems like the Linux kernel.

The implications of RefluXFS extend to enterprise environments, particularly those with cloud-native architectures and containerized deployments. Systems running in multi-tenant environments, where isolation between users or containers is paramount, are at heightened risk if they utilize XFS with reflink enabled and are not promptly patched. The ability to gain persistent root access can lead to data breaches, system compromise, and significant operational disruption.

As the cybersecurity landscape continues to evolve, the RefluXFS vulnerability serves as a stark reminder of the persistent threats lurking within complex software. The ongoing efforts of security researchers, the swift response of Linux vendors, and the critical role of prompt patching and system reboots are essential in mitigating such risks and ensuring the integrity and security of our digital infrastructure. Users are strongly encouraged to consult their respective distribution’s security advisories and apply the necessary kernel updates without delay.