RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)

Key facts for RefluXFS XFS copy-on-write race

Detection coverage for RefluXFS XFS copy-on-write race

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1629 across Splunk SPL, Microsoft KQL and Sigma, covering 60 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RefluXFS Silent Privileged-File Overwrite With No Audit Trail (C2/Lateral-Movement-Equivalent Persistence Landing)

Detects modification of /etc/passwd, /etc/shadow, or a SUID-root binary with no corresponding audit-rule match or package-manager transaction -- the anti-forensic signature of a successful RefluXFS stale-block-reuse overwrite landing attacker-controlled bytes in a root-owned file, functionally equivalent to a C2 foothold/lateral-persistence landing since it grants passwordless root without conventional telemetry.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1070, T1222, T1565, T1098, T1136
• Data sources: linux_fim, linux_auditd, rpm/dpkg transaction logs
• Severity: critical
• Confidence: high

Splunk SPL

index=linux_fim sourcetype="linux:fim" (file_path="/etc/passwd" OR file_path="/etc/shadow" OR file_perms="*4755*" OR file_perms="*4711*")
| join type=left file_path [ search index=linux_auditd sourcetype="linux:audit" AuditRuleMatched=true | fields file_path ]
| join type=left file_path [ search index=linux_pkgmgr (sourcetype="linux:rpm" OR sourcetype="linux:dpkg") | fields file_path ]
| where isnull(AuditRuleMatched) AND isnull(pkg_transaction_id)
| table _time host file_path file_hash file_perms

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in ("passwd", "shadow") or (AdditionalFields has "suid" and ActionType == "FileModified")
| join kind=leftanti (SecurityEvent | where EventID == 1804) on $left.SHA256 == $right.SHA256
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, SHA256

Sigma

title: RefluXFS Silent /etc/passwd or SUID-Root Binary Modification With No Preceding Audit Entry
id: 3d4e5f6a-7b8c-49d0-a1e2-refluxfsafp
status: experimental
description: Detects modification of /etc/passwd, /etc/shadow, or a SUID-root binary with no corresponding audit-log or package-manager transaction, the anti-forensic pattern left by a successful RefluXFS (CVE-2026-64600) stale-block-reuse overwrite that grants passwordless root without a kernel crash or LSM denial.
references:
    - https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.defense-evasion
    - attack.t1070
    - attack.t1222.002
    - attack.t1565
    - cve.2026.64600
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '/etc/passwd'
            - '/etc/shadow'
    filter_expected_audit:
        AuditRuleMatched: true
    filter_pkg_txn:
        PackageManagerTransaction: true
    condition: selection and not filter_expected_audit and not filter_pkg_txn
falsepositives:
    - Sanctioned config-management (Ansible/Puppet/Chef) runs executed without audit-rule coverage or package manager transactions
level: critical

Known false positives:

• Sanctioned config-management (Ansible/Puppet/Chef) runs executed outside audit-rule coverage or package-manager transaction tracking

Tuning notes: Correlate against a config-management change-window allowlist (e.g. Ansible run IDs) before alerting, and require the file-integrity monitor to be actively baselined on the host to avoid missed-baseline false positives.

• 🔒 RefluXFS Reflink Clone of Sensitive File (Exploitation Precondition) — Sentinel · unlock with TL Creds
• 🔒 RefluXFS Concurrent O_DIRECT Writers Against Same File (Race Trigger) — Sentinel · unlock with TL Creds
• 🔒 RefluXFS Unauthorized Root Account Creation in [indicator] (Post-Exploitation Persistence) — Sentinel · unlock with TL Creds
• 🔒 RefluXFS Reflink Clone Precondition Chain (Sigma) · unlock with TL Creds
• 🔒 RefluXFS SUID-Root Binary Tamper Without Package-Manager Transaction (Sigma) · unlock with TL Creds
• 🔒 RefluXFS Post-Exploitation Root Shell Spawn From Recently-Tampered Binary Path (C2/Lateral-Movement Equivalent) · unlock with TL Creds
• 🔒 RefluXFS Reflink Clone of Sensitive File (Exploitation Precondition) · unlock with TL Creds
• 🔒 RefluXFS Concurrent O_DIRECT Writers Against Same Reflinked Inode (Race Trigger) · unlock with TL Creds

Indicators of compromise for RefluXFS XFS copy-on-write race

As of 2026-07-25, Threadlinqs Intelligence tracks 60 indicators of compromise for TL-2026-1629.

Sample indicators (3 of 60)

• File hash: 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7
• File hash: 206c09b04dc5469c7ff14d8aceff2d47c88078d9
• File hash: 44f891bc088958399eec27f7604928694aa35581

Defanged, TLP:CLEAR. Full set of 60 indicators: unlock with TL Creds.

How RefluXFS XFS copy-on-write race works

A working, author-verified proof-of-concept reliably overwrites /etc/passwd or SUID-root binaries to obtain passwordless root, persisting across reboots with no kernel log artifacts.

RefluXFS (CVE-2026-64600) is a race-condition vulnerability in the Linux kernel's XFS filesystem copy-on-write (reflink) code path. During a copy-on-write operation triggered by an O_DIRECT write to a reflinked file, the kernel drops the inode lock while it waits for transaction log space. If a second, concurrent O_DIRECT write targets the same reflinked file during this window, that second writer can complete its own copy-on-write and remap the file's physical blocks before the first writer resumes. When the first writer reacquires the inode lock, it does so using a block address and reference-count snapshot captured before the lock was dropped -- now stale. Believing the block is still exclusively owned (private) by its own copy, the first writer's I/O commits directly to the underlying physical block, which by then belongs to (or is shared with) the original, unmodified file. The net effect is that an unprivileged local user who can create a reflinked copy of an existing file (for example, using `cp --reflink` or `ioctl(FICLONE)`) can, by carefully racing two O_DIRECT writers against that copy, cause the kernel to write attacker-controlled bytes into the original file's on-disk blocks -- including files the attacker would otherwise have no write permission to, such as /etc/passwd or SUID-root binaries. Qualys TRU demonstrated a reliable, author-verified proof-of-concept exploit that wins this race deterministically enough to add a passwordless root entry to /etc/passwd or corrupt a SUID-root binary to spawn a root shell. Because the write path goes through the normal filesystem/page-cache write path rather than a memory-corruption primitive, the exploit leaves no kernel crash, no SELinux/AppArmor denial, and no dmesg/kernel-log artifact, and the tampered file persists across reboots. Standard kernel hardening (KASLR, SMEP, SMAP, seccomp) and mandatory access control (SELinux) do not prevent exploitation because the bug operates entirely within the filesystem's block-allocation and reference-counting layer, not the memory-management or syscall-filtering layers. The bug requires three preconditions to be exploitable on a given host: (1) a Linux kernel version 4.11 (2017, when XFS reflink/CoW support landed) or later without the fix; (2) an XFS filesystem mounted with reflink support enabled (the default on most modern enterprise Linux XFS deployments); and (3) attacker access to a writable directory on that filesystem. Because reflink-enabled XFS is the default root/data filesystem on numerous enterprise Linux distributions, Qualys estimates the exposure at over 16.4 million systems worldwide. Disclosure was coordinated with XFS upstream maintainers (Darrick J. Wong, Carlos Maiolino) and stable-kernel maintainer Greg Kroah-Hartman via the linux-distros mailing list ahead of the July 22, 2026 public writeup. Qualys states that immediate kernel patching followed by a full reboot is the only reliable remediation; there is no viable mitigation or workaround short of patching (e.g., disabling reflink filesystem-wide is disruptive and not offered as vendor guidance in the source advisory). RefluXFS is part of a broader 2026 pattern of Linux kernel local-privilege-escalation bugs rooted in copy-on-write / page-cache write-primitive races -- alongside Fragnesia (CVE-2026-46300, XFRM ESP-in-TCP skb frag-sharing bug), pedit COW (CVE-2026-46331, act_pedit traffic-control COW range miscalculation), and Dirty Frag (CVE-2026-43284) -- all of which give a local unprivileged user a page-cache write primitive that lands directly in a root-owned or SUID file without triggering conventional kernel-crash or LSM-denial telemetry.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1556 Modify Authentication Process

Collection

T1005 Data from Local System

Defense Evasion

T1006 Direct Volume Access; T1070 Indicator Removal; T1211 Exploitation for Stealth

Discovery

T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Initial Access

T1078 Valid Accounts

Persistence

T1098 Account Manipulation; T1136 Create Account; T1554 Compromise Host Software Binary

defense-impairment

T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools

Impact

T1565 Data Manipulation

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information

Remediation for RefluXFS XFS copy-on-write race

Patches

• Apply the upstream XFS fix for CVE-2026-64600 once merged into stable/LTS kernel trees and backported by distribution vendors (patch not yet published in the source advisory as of 2026-07-22).

Immediate actions

• Apply the vendor kernel patch for CVE-2026-64600 as soon as it is released for your distribution and fully reboot affected hosts (in-memory kernel fixes are not sufficient -- the running kernel must be replaced).
• Until a patch is deployed, restrict local shell/interactive access on XFS-with-reflink hosts to trusted administrators only, since exploitation requires only an unprivileged local session and a writable directory.
• Audit /etc/passwd and SUID-root binaries on reflink-enabled XFS hosts for unexpected root entries or unexpected file modification timestamps, since the exploit persists silently with no kernel log artifact.

Workarounds

• No fully effective workaround short of patching is documented by the source advisory; disabling reflink support filesystem-wide removes the vulnerable code path but is disruptive to CoW-dependent workflows and is not offered as official vendor guidance.

Longer-term hardening

• Track and apply RHEL/CentOS Stream/Oracle Linux/Rocky/AlmaLinux/CloudLinux/Amazon Linux/Fedora kernel errata for CVE-2026-64600 as each vendor publishes them.
• Where feasible, disable XFS reflink (reflink=0) on filesystems that do not require deduplication/CoW features, reducing exposure until patched kernels are fully rolled out.
• Deploy file-integrity monitoring (FIM) on /etc/passwd, /etc/shadow, and SUID-root binaries to detect silent tampering that bypasses kernel audit/log-based detection.
• Track this bug alongside the broader 2026 CoW/page-cache-write-primitive LPE cluster (Fragnesia, pedit COW, Dirty Frag) when prioritizing kernel patch cadence.

Affected and fixed versions

• Linux Kernel — XFS Filesystem (Copy-on-Write / reflink)
  Vulnerable versions: 4.11 and later without the fix
  Fixed in: pending vendor patch as of 2026-07-22
• Red Hat — Red Hat Enterprise Linux
  Vulnerable versions: 8; 9; 10
  Fixed in: pending
• Red Hat — CentOS Stream
  Vulnerable versions: 8; 9; 10
  Fixed in: pending
• Oracle — Oracle Linux
  Vulnerable versions: 8; 9; 10
  Fixed in: pending
• Rocky Linux — Rocky Linux
  Vulnerable versions: 8; 9; 10
  Fixed in: pending
• AlmaLinux OS Foundation — AlmaLinux
  Vulnerable versions: 8; 9; 10
  Fixed in: pending
• CloudLinux — CloudLinux OS
  Vulnerable versions: 8; 9; 10
  Fixed in: pending
• Amazon — Amazon Linux
  Vulnerable versions: 2 (from December 2022 onward); 2023
  Fixed in: pending
• Fedora Project — Fedora Server
  Vulnerable versions: 31 and later
  Fixed in: pending

Timeline of RefluXFS XFS copy-on-write race

Last updated 2026-07-25 · 5 updates · revalidated 5× · latest source

Showing the 20 most recent tracked events.

• 2026-07-10 CVE-2026-64600 auto-imported into Red Hat Bugzilla for tracking.
• 2026-07-14 Fix commit 2f4acd0 ("xfs: resample the data fork mapping after cycling ILOCK") committed to the XFS development tree; Red Hat begins shipping kernel updates.
• 2026-07-15 Advisory distributed to the linux-distros coordination mailing list ahead of public disclosure.
• 2026-07-16 The fix for the XFS reflink race condition is merged into the upstream Linux kernel tree, ahead of the public disclosure.
• 2026-07-17 Red Hat completes rollout of RHSA-2026:39179, RHSA-2026:39180, and RHSA-2026:39494 kernel advisories; stable backports land in 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4+.
• 2026-07-22 RHEL, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Amazon Linux, and Fedora Server begin backporting the upstream kernel fix to their respective enterprise kernel branches.
• 2026-07-22 CVE-2026-64600 is confirmed absent from the CISA Known Exploited Vulnerabilities catalog (2026-07-22 release), consistent with no confirmed in-the-wild exploitation at time of disclosure.
• 2026-07-22 Cyber Security News and Security Online publish independent technical writeups summarizing the Qualys advisory, exploit mechanics, and the estimated 16.4 million potentially affected systems.
• 2026-07-22 Qualys releases detection coverage concurrent with disclosure: QID 45097 (kernel version fingerprinting) plus distribution-specific QIDs (6600012, 6053109, 6053104, and related) shipped in VULNSIGS versions 2.6.651 through 2.6.656-2.
• 2026-07-22 Qualys advisory additionally credits Linux maintainers locked-ioc-44, locked-ioc-41, and locked-ioc-45 for review/coordination alongside the primary XFS and stable-kernel maintainers.
• 2026-07-22 Qualys enumerates affected enterprise Linux distributions running kernel 4.11+ with XFS reflink enabled: RHEL, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux (8/9/10), Amazon Linux 2 (Dec 2022+) and 2023, and Fedora Server 31+.
• 2026-07-22 Qualys states that immediate kernel patching followed by a full reboot is the only reliable mitigation, noting standard hardening (KASLR, SMEP, SMAP, SELinux, seccomp) does not prevent exploitation.
• 2026-07-22 Qualys estimates the vulnerability potentially impacts over 16.4 million systems worldwide, based on asset-management analysis of reflink-enabled XFS deployments.
• 2026-07-22 Disclosure coordinated ahead of publication with XFS upstream maintainers locked-ioc-39 and locked-ioc-40, and stable-kernel maintainer locked-ioc-36, via the linux-distros mailing list.
• 2026-07-22 Qualys TRU demonstrates a working, reliable proof-of-concept exploit that overwrites locked-ioc-52 or SUID-root binaries to obtain passwordless root access.
• 2026-07-22 Qualys Threat Research Unit publicly discloses RefluXFS (CVE-2026-64600), a race condition in the Linux kernel XFS copy-on-write path, via technical blog writeup.
• 2026-07-23 NVD publishes the CVE-2026-64600 entry.
• 2026-07-23 BleepingComputer and additional outlets (SOC Prime, CyberPress, Network World, CSO Online, Cybersecurity News) publish independent coverage of CVE-2026-64600, estimating 16.4M+ exposed systems -- a broader/later wave than the outlets previously on record.
• 2026-07-24 NVD's CVE-2026-64600 record is last modified; Red Hat's official CVSS 3.1 score of 7.8 (Important, CWE-362) is reflected in vendor security data.
• 2026-07-24 Additional syndicated news coverage and vendor blog analysis (TuxCare) of the RefluXFS flaw and RHEL exposure continues to circulate.

Update history

• 2026-07-25 — RefluXFS (CVE-2026-64600): Nine-Year-Old Linux XFS Reflink Race Condition Enables Local Root Privilege Escalation: What changed CVSS newly assigned: null → CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), rated "Important" by Red Hat. Severity, exploitability, and status are unchanged (HIGH / POC_PUBLIC / PATCHED) — the newer report's more detailed v
• 2026-07-25 — RefluXFS: XFS Reflink Direct-I/O Race Condition Grants Root Privileges (CVE-2026-64600): What changed Status escalated ACTIVE - PATCHED: the newer report confirms fix commit 2f4acd0 ("xfs: resample the data fork mapping after cycling ILOCK") merged to mainline on 2026-07-16 and vendor kernel updates (RHSA/ELSA/ALSA/RLSA/FEDORA)
• 2026-07-23 — CVE-2026-64600 (RefluXFS): Linux Kernel XFS Reflink Direct-I/O Race Condition Leads to Root Privilege Escalation: What changed No field escalations: severity (HIGH), exploitability (POC_PUBLIC), status (ACTIVE), and attribution (LOW/Unknown) are unchanged. The update is additive detail rather than an escalation — a fully-resolved patch/backport timelin
• 2026-07-23 — RefluXFS (CVE-2026-64600): Linux Kernel XFS Reflink Copy-on-Write Race Condition Enables Local Privilege Escalation to Root: What changed No field escalations -- severity (HIGH), exploitability (POC_PUBLIC), and status (ACTIVE) are unchanged; the newer report's 'impact: CRITICAL' (vs the existing record's HIGH) is not a whitelisted revalidation field, so it is no
• 2026-07-23 — RefluXFS (CVE-2026-64600): Linux XFS Reflink Race Condition Enables Local Root Privilege Escalation: What changed No whitelisted field escalated (severity HIGH, exploitability POC_PUBLIC, status ACTIVE, attribution LOW/Unknown all unchanged); the substantive change is added evidentiary detail: the upstream kernel fix was merged 2026-07-16,

Sources cited for RefluXFS XFS copy-on-write race

• RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) blog.qualys.com · Advisory · 2026-07-22
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-64600 not listed as of 2026-07-22) CISA · Government advisory · 2026-07-22
• Linux Kernel Local Privilege Escalation Vulnerability Exploited in Attacks (Fragnesia) (CVE-2026-46300) threatprotect.qualys.com · Research · 2026-05-15
• pedit COW (CVE-2026-46331): Mitigation and Kernel Update on CloudLinux blog.cloudlinux.com · Vendor report · 2026-06-17
• CVE-2026-46300 (Fragnesia) Reference Tenable · Research · 2026-05-13
• CVE-2026-64600 (RefluXFS) — NVD Record (RESERVED, not yet populated) NVD (NIST) · Research · 2026-07-22
• pedit-cow (CVE-2026-46331): Linux tc Flaw Grants Root tuxcare.com · Blog · 2026-06-17

Threats related to RefluXFS XFS copy-on-write race

• OVSWrap (CVE-2026-64531): Linux kernel Open vSwitch datapath 16-bit nla_len wraparound local privilege escalation with public PoC targeting ~800 x86-64 kernel builds
• Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)
• DirtyDecrypt / DirtyCBC — Linux Kernel rxgk Root LPE with Public PoC (CVE-2026-31635)
• F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON)
• DirtyClone (CVE-2026-43503): Linux Kernel Packet-Cloning Page-Cache Write Enables Local Privilege Escalation to Root via IPsec ESP

Related coverage of this activity

• Copy Fail Linux root exploit
• Linux DRM GEM root exploit
• Dirty Frag Linux LPE
• Linux FUSE page-cache LPE
• Fragnesia Linux kernel LPE

Previous and next in vulnerability

• Apple Hide My Email Flaw Exposed Real Email Addresses via Spam-Filter/Bounce Triggering Previous report
• Prompt Injection in AWS Kiro Leads to Remote Code Execution via Unprotected MCP Config (mcp.json) Next report