RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition (TL-2026-1629), also tracked as RefluXFS, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-22 and last reviewed 2026-07-25. It has no confirmed attribution, affects Linux Kernel XFS Filesystem (Copy-on-Write / reflink), references 1 CVE (CVE-2026-64600), maps to 28 MITRE ATT&CK techniques (T1003, T1005, T1006), and is covered by 9 detection rules and 60 indicators of compromise.
Key facts for TL-2026-1629
- Threat ID
- TL-2026-1629
- Also known as
- RefluXFS
- Severity
- HIGH
- CVSS
- 7.8
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-22
- Last reviewed
- 2026-07-25
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 60
- Updates
- 2026-07-25 · 5 updates · revalidated 5× · latest source
Malware and tooling in RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition
Malware and tooling: Qualys QID 45097, Qualys VULNSIGS 2.6.651-2.6.656-2, Qualys distribution QIDs 6600012, 6053109, 6053104
Qualys TRU disclosed RefluXFS, a race condition in the Linux kernel XFS filesystem's copy-on-write path that lets a local unprivileged attacker overwrite arbitrary readable files and escalate to root. Two concurrent O_DIRECT writes to the same reflinked file cause the kernel to reuse a stale block address after re-acquiring its inode lock, bypassing page-cache protections. A working, author-verified proof-of-concept reliably overwrites /etc/passwd or SUID-root binaries to obtain passwordless root, persisting across reboots with no kernel log artifacts.
How RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition works
RefluXFS (CVE-2026-64600) is a race-condition vulnerability in the Linux kernel's XFS filesystem copy-on-write (reflink) code path. During a copy-on-write operation triggered by an O_DIRECT write to a reflinked file, the kernel drops the inode lock while it waits for transaction log space. If a second, concurrent O_DIRECT write targets the same reflinked file during this window, that second writer can complete its own copy-on-write and remap the file's physical blocks before the first writer resumes. When the first writer reacquires the inode lock, it does so using a block address and reference-count snapshot captured before the lock was dropped -- now stale. Believing the block is still exclusively owned (private) by its own copy, the first writer's I/O commits directly to the underlying physical block, which by then belongs to (or is shared with) the original, unmodified file. The net effect is that an unprivileged local user who can create a reflinked copy of an existing file (for example, using `cp --reflink` or `ioctl(FICLONE)`) can, by carefully racing two O_DIRECT writers against that copy, cause the kernel to write attacker-controlled bytes into the original file's on-disk blocks -- including files the attacker would otherwise have no write permission to, such as /etc/passwd or SUID-root binaries. Qualys TRU demonstrated a reliable, author-verified proof-of-concept exploit that wins this race deterministically enough to add a passwordless root entry to /etc/passwd or corrupt a SUID-root binary to spawn a root shell. Because the write path goes through the normal filesystem/page-cache write path rather than a memory-corruption primitive, the exploit leaves no kernel crash, no SELinux/AppArmor denial, and no dmesg/kernel-log artifact, and the tampered file persists across reboots. Standard kernel hardening (KASLR, SMEP, SMAP, seccomp) and mandatory access control (SELinux) do not prevent exploitation because the bug operates entirely within the filesystem's block-allocation and reference-counting layer, not the memory-management or syscall-filtering layers. The bug requires three preconditions to be exploitable on a given host: (1) a Linux kernel version 4.11 (2017, when XFS reflink/CoW support landed) or later without the fix; (2) an XFS filesystem mounted with reflink support enabled (the default on most modern enterprise Linux XFS deployments); and (3) attacker access to a writable directory on that filesystem. Because reflink-enabled XFS is the default root/data filesystem on numerous enterprise Linux distributions, Qualys estimates the exposure at over 16.4 million systems worldwide. Disclosure was coordinated with XFS upstream maintainers (Darrick J. Wong, Carlos Maiolino) and stable-kernel maintainer Greg Kroah-Hartman via the linux-distros mailing list ahead of the July 22, 2026 public writeup. Qualys states that immediate kernel patching followed by a full reboot is the only reliable remediation; there is no viable mitigation or workaround short of patching (e.g., disabling reflink filesystem-wide is disruptive and not offered as vendor guidance in the source advisory). RefluXFS is part of a broader 2026 pattern of Linux kernel local-privilege-escalation bugs rooted in copy-on-write / page-cache write-primitive races -- alongside Fragnesia (CVE-2026-46300, XFRM ESP-in-TCP skb frag-sharing bug), pedit COW (CVE-2026-46331, act_pedit traffic-control COW range miscalculation), and Dirty Frag (CVE-2026-43284) -- all of which give a local unprivileged user a page-cache write primitive that lands directly in a root-owned or SUID file without triggering conventional kernel-crash or LSM-denial telemetry.
MITRE ATT&CK techniques used in TL-2026-1629
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1556 Modify Authentication Process
Collection
Defense Evasion
T1006 Direct Volume Access; T1070 Indicator Removal; T1211 Exploitation for Stealth
Discovery
T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host
Initial Access
Persistence
T1098 Account Manipulation; T1136 Create Account; T1554 Compromise Host Software Binary
defense-impairment
T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools
Impact
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition
- Linux Kernel — XFS Filesystem (Copy-on-Write / reflink)
Vulnerable versions: 4.11 and later without the fix
Fixed in: pending vendor patch as of 2026-07-22 - Red Hat — Red Hat Enterprise Linux
Vulnerable versions: 8; 9; 10
Fixed in: pending - Red Hat — CentOS Stream
Vulnerable versions: 8; 9; 10
Fixed in: pending - Oracle — Oracle Linux
Vulnerable versions: 8; 9; 10
Fixed in: pending - Rocky Linux — Rocky Linux
Vulnerable versions: 8; 9; 10
Fixed in: pending - AlmaLinux OS Foundation — AlmaLinux
Vulnerable versions: 8; 9; 10
Fixed in: pending - CloudLinux — CloudLinux OS
Vulnerable versions: 8; 9; 10
Fixed in: pending - Amazon — Amazon Linux
Vulnerable versions: 2 (from December 2022 onward); 2023
Fixed in: pending - Fedora Project — Fedora Server
Vulnerable versions: 31 and later
Fixed in: pending
Remediation for RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition
Patches
- Apply the upstream XFS fix for CVE-2026-64600 once merged into stable/LTS kernel trees and backported by distribution vendors (patch not yet published in the source advisory as of 2026-07-22).
Immediate actions
- Apply the vendor kernel patch for CVE-2026-64600 as soon as it is released for your distribution and fully reboot affected hosts (in-memory kernel fixes are not sufficient -- the running kernel must be replaced).
- Until a patch is deployed, restrict local shell/interactive access on XFS-with-reflink hosts to trusted administrators only, since exploitation requires only an unprivileged local session and a writable directory.
- Audit /etc/passwd and SUID-root binaries on reflink-enabled XFS hosts for unexpected root entries or unexpected file modification timestamps, since the exploit persists silently with no kernel log artifact.
Workarounds
- No fully effective workaround short of patching is documented by the source advisory; disabling reflink support filesystem-wide removes the vulnerable code path but is disruptive to CoW-dependent workflows and is not offered as official vendor guidance.
Longer-term hardening
- Track and apply RHEL/CentOS Stream/Oracle Linux/Rocky/AlmaLinux/CloudLinux/Amazon Linux/Fedora kernel errata for CVE-2026-64600 as each vendor publishes them.
- Where feasible, disable XFS reflink (reflink=0) on filesystems that do not require deduplication/CoW features, reducing exposure until patched kernels are fully rolled out.
- Deploy file-integrity monitoring (FIM) on /etc/passwd, /etc/shadow, and SUID-root binaries to detect silent tampering that bypasses kernel audit/log-based detection.
- Track this bug alongside the broader 2026 CoW/page-cache-write-primitive LPE cluster (Fragnesia, pedit COW, Dirty Frag) when prioritizing kernel patch cadence.
CVEs associated with RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition
Weaknesses (CWE) in RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition
CWE-362, CWE-367
Timeline of RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition
Showing the 20 most recent tracked events.
- CVE-2026-64600 auto-imported into Red Hat Bugzilla for tracking.
- Fix commit 2f4acd0 ("xfs: resample the data fork mapping after cycling ILOCK") committed to the XFS development tree; Red Hat begins shipping kernel updates.
- Advisory distributed to the linux-distros coordination mailing list ahead of public disclosure.
- The fix for the XFS reflink race condition is merged into the upstream Linux kernel tree, ahead of the public disclosure.
- Red Hat completes rollout of RHSA-2026:39179, RHSA-2026:39180, and RHSA-2026:39494 kernel advisories; stable backports land in 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4+.
- RHEL, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Amazon Linux, and Fedora Server begin backporting the upstream kernel fix to their respective enterprise kernel branches.
- CVE-2026-64600 is confirmed absent from the CISA Known Exploited Vulnerabilities catalog (2026-07-22 release), consistent with no confirmed in-the-wild exploitation at time of disclosure.
- Cyber Security News and Security Online publish independent technical writeups summarizing the Qualys advisory, exploit mechanics, and the estimated 16.4 million potentially affected systems.
- Qualys releases detection coverage concurrent with disclosure: QID 45097 (kernel version fingerprinting) plus distribution-specific QIDs (6600012, 6053109, 6053104, and related) shipped in VULNSIGS versions 2.6.651 through 2.6.656-2.
- Qualys advisory additionally credits Linux maintainers Linus Torvalds, David Woodhouse, and Willy Tarreau for review/coordination alongside the primary XFS and stable-kernel maintainers.
- Qualys enumerates affected enterprise Linux distributions running kernel 4.11+ with XFS reflink enabled: RHEL, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux (8/9/10), Amazon Linux 2 (Dec 2022+) and 2023, and Fedora Server 31+.
- Qualys states that immediate kernel patching followed by a full reboot is the only reliable mitigation, noting standard hardening (KASLR, SMEP, SMAP, SELinux, seccomp) does not prevent exploitation.
- Qualys estimates the vulnerability potentially impacts over 16.4 million systems worldwide, based on asset-management analysis of reflink-enabled XFS deployments.
- Disclosure coordinated ahead of publication with XFS upstream maintainers Darrick J. Wong and Carlos Maiolino, and stable-kernel maintainer Greg Kroah-Hartman, via the linux-distros mailing list.
- Qualys TRU demonstrates a working, reliable proof-of-concept exploit that overwrites /etc/passwd or SUID-root binaries to obtain passwordless root access.
- Qualys Threat Research Unit publicly discloses RefluXFS (CVE-2026-64600), a race condition in the Linux kernel XFS copy-on-write path, via technical blog writeup.
- NVD publishes the CVE-2026-64600 entry.
- BleepingComputer and additional outlets (SOC Prime, CyberPress, Network World, CSO Online, Cybersecurity News) publish independent coverage of CVE-2026-64600, estimating 16.4M+ exposed systems -- a broader/later wave than the outlets previously on record.
- NVD's CVE-2026-64600 record is last modified; Red Hat's official CVSS 3.1 score of 7.8 (Important, CWE-362) is reflected in vendor security data.
- Additional syndicated news coverage and vendor blog analysis (TuxCare) of the RefluXFS flaw and RHEL exposure continues to circulate.
Update history for TL-2026-1629
- 2026-07-25 — RefluXFS (CVE-2026-64600): Nine-Year-Old Linux XFS Reflink Race Condition Enables Local Root Privilege Escalation: What changed CVSS newly assigned: null → CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), rated "Important" by Red Hat. Severity, exploitability, and status are unchanged (HIGH / POC_PUBLIC / PATCHED) — the newer report's more detailed v
- 2026-07-25 — RefluXFS: XFS Reflink Direct-I/O Race Condition Grants Root Privileges (CVE-2026-64600): What changed Status escalated ACTIVE - PATCHED: the newer report confirms fix commit 2f4acd0 ("xfs: resample the data fork mapping after cycling ILOCK") merged to mainline on 2026-07-16 and vendor kernel updates (RHSA/ELSA/ALSA/RLSA/FEDORA)
- 2026-07-23 — CVE-2026-64600 (RefluXFS): Linux Kernel XFS Reflink Direct-I/O Race Condition Leads to Root Privilege Escalation: What changed No field escalations: severity (HIGH), exploitability (POC_PUBLIC), status (ACTIVE), and attribution (LOW/Unknown) are unchanged. The update is additive detail rather than an escalation — a fully-resolved patch/backport timelin
- 2026-07-23 — RefluXFS (CVE-2026-64600): Linux Kernel XFS Reflink Copy-on-Write Race Condition Enables Local Privilege Escalation to Root: What changed No field escalations -- severity (HIGH), exploitability (POC_PUBLIC), and status (ACTIVE) are unchanged; the newer report's 'impact: CRITICAL' (vs the existing record's HIGH) is not a whitelisted revalidation field, so it is no
- 2026-07-23 — RefluXFS (CVE-2026-64600): Linux XFS Reflink Race Condition Enables Local Root Privilege Escalation: What changed No whitelisted field escalated (severity HIGH, exploitability POC_PUBLIC, status ACTIVE, attribution LOW/Unknown all unchanged); the substantive change is added evidentiary detail: the upstream kernel fix was merged 2026-07-16,
Sources cited for RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition
- RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)
- Linux Kernel Local Privilege Escalation Vulnerability Exploited in Attacks (Fragnesia) (CVE-2026-46300)
- pedit COW (CVE-2026-46331): Mitigation and Kernel Update on CloudLinux
- pedit-cow (CVE-2026-46331): Linux tc Flaw Grants Root
- CVE-2026-46300 (Fragnesia) Reference
- CVE-2026-64600 (RefluXFS) — NVD Record (RESERVED, not yet populated)
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-64600 not listed as of 2026-07-22)
Threats related to RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition
- OVSWrap (CVE-2026-64531): Linux kernel Open vSwitch datapath 16-bit nla_len wraparound local privilege escalation with public PoC targeting ~800 x86-64 kernel builds
- Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)
- DirtyDecrypt / DirtyCBC — Linux Kernel rxgk Root LPE with Public PoC (CVE-2026-31635)
- F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON)
- DirtyClone (CVE-2026-43503): Linux Kernel Packet-Cloning Page-Cache Write Enables Local Privilege Escalation to Root via IPsec ESP
- CVE-2026-46215: Linux Kernel DRM GEM_CHANGE_HANDLE Use-After-Free Local Root Privilege Escalation
Detection coverage for TL-2026-1629
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1629 across Splunk SPL, Microsoft KQL and Sigma, covering 60 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.