# RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)

> Qualys TRU disclosed RefluXFS, a race condition in the Linux kernel XFS filesystem's copy-on-write path that lets a local unprivileged attacker overwrite arbitrary readable files and escalate to root. Two concurrent O_DIRECT writes to the same reflinked file cause the kernel to reuse a stale block address after re-acquiring its inode lock, bypassing page-cache protections. A working, author-verified proof-of-concept reliably overwrites /etc/passwd or SUID-root binaries to obtain passwordless root, persisting across reboots with no kernel log artifacts.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-25T22:22:45.149Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1629
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-refluxfs-xfs-copy-on-write-race-tl-2026-1629.webp?v=770ed9d2 (Threadlinqs threat intel: CVE-2026-64600 RefluXFS Linux XFS Race: Detection & IOCs (TL-2026-1629) — High severity, 60 IOCs, 9 detection rules.)
- **ID:** TL-2026-1629
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 60 (3 shown free below)
- **CVEs:** CVE-2026-64600

## Description

RefluXFS (CVE-2026-64600) is a race-condition vulnerability in the Linux kernel's XFS filesystem copy-on-write (reflink) code path. During a copy-on-write operation triggered by an O_DIRECT write to a reflinked file, the kernel drops the inode lock while it waits for transaction log space. If a second, concurrent O_DIRECT write targets the same reflinked file during this window, that second writer can complete its own copy-on-write and remap the file's physical blocks before the first writer resumes. When the first writer reacquires the inode lock, it does so using a block address and reference-count snapshot captured before the lock was dropped -- now stale. Believing the block is still exclusively owned (private) by its own copy, the first writer's I/O commits directly to the underlying physical block, which by then belongs to (or is shared with) the original, unmodified file. The net effect is that an unprivileged local user who can create a reflinked copy of an existing file (for example, using `cp --reflink` or `ioctl(FICLONE)`) can, by carefully racing two O_DIRECT writers against that copy, cause the kernel to write attacker-controlled bytes into the original file's on-disk blocks -- including files the attacker would otherwise have no write permission to, such as /etc/passwd or SUID-root binaries. Qualys TRU demonstrated a reliable, author-verified proof-of-concept exploit that wins this race deterministically enough to add a passwordless root entry to /etc/passwd or corrupt a SUID-root binary to spawn a root shell. Because the write path goes through the normal filesystem/page-cache write path rather than a memory-corruption primitive, the exploit leaves no kernel crash, no SELinux/AppArmor denial, and no dmesg/kernel-log artifact, and the tampered file persists across reboots. Standard kernel hardening (KASLR, SMEP, SMAP, seccomp) and mandatory access control (SELinux) do not prevent exploitation because the bug operates entirely within the filesystem's block-allocation and reference-counting layer, not the memory-management or syscall-filtering layers. The bug requires three preconditions to be exploitable on a given host: (1) a Linux kernel version 4.11 (2017, when XFS reflink/CoW support landed) or later without the fix; (2) an XFS filesystem mounted with reflink support enabled (the default on most modern enterprise Linux XFS deployments); and (3) attacker access to a writable directory on that filesystem. Because reflink-enabled XFS is the default root/data filesystem on numerous enterprise Linux distributions, Qualys estimates the exposure at over 16.4 million systems worldwide. Disclosure was coordinated with XFS upstream maintainers (Darrick J. Wong, Carlos Maiolino) and stable-kernel maintainer Greg Kroah-Hartman via the linux-distros mailing list ahead of the July 22, 2026 public writeup. Qualys states that immediate kernel patching followed by a full reboot is the only reliable remediation; there is no viable mitigation or workaround short of patching (e.g., disabling reflink filesystem-wide is disruptive and not offered as vendor guidance in the source advisory). RefluXFS is part of a broader 2026 pattern of Linux kernel local-privilege-escalation bugs rooted in copy-on-write / page-cache write-primitive races -- alongside Fragnesia (CVE-2026-46300, XFRM ESP-in-TCP skb frag-sharing bug), pedit COW (CVE-2026-46331, act_pedit traffic-control COW range miscalculation), and Dirty Frag (CVE-2026-43284) -- all of which give a local unprivileged user a page-cache write primitive that lands directly in a root-owned or SUID file without triggering conventional kernel-crash or LSM-denial telemetry.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1098 Account Manipulation
- T1136 Create Account
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1006 Direct Volume Access
- T1222 File and Directory Permissions Modification
- T1059 Command and Scripting Interpreter
- T1082 System Information Discovery
- T1588 Obtain Capabilities
- T1565 Data Manipulation
- T1592 Gather Victim Host Information
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1685 Disable or Modify Tools
- T1556 Modify Authentication Process
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1552 Unsecured Credentials
- T1069 Permission Groups Discovery
- T1587 Develop Capabilities
- T1611 Escape to Host
- T1003 OS Credential Dumping
- T1033 System Owner/User Discovery
- T1106 Native API
- T1554 Compromise Host Software Binary

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RefluXFS Silent Privileged-File Overwrite With No Audit Trail (C2/Lateral-Movement-Equivalent Persistence Landing)** (`TL-2026-1629-SPL-003`)

Detects modification of /etc/passwd, /etc/shadow, or a SUID-root binary with no corresponding audit-rule match or package-manager transaction -- the anti-forensic signature of a successful RefluXFS stale-block-reuse overwrite landing attacker-controlled bytes in a root-owned file, functionally equivalent to a C2 foothold/lateral-persistence landing since it grants passwordless root without conventional telemetry.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1070, T1222, T1565, T1098, T1136
- **Data sources:** linux_fim, linux_auditd, rpm/dpkg transaction logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux_fim sourcetype="linux:fim" (file_path="/etc/passwd" OR file_path="/etc/shadow" OR file_perms="*4755*" OR file_perms="*4711*")
| join type=left file_path [ search index=linux_auditd sourcetype="linux:audit" AuditRuleMatched=true | fields file_path ]
| join type=left file_path [ search index=linux_pkgmgr (sourcetype="linux:rpm" OR sourcetype="linux:dpkg") | fields file_path ]
| where isnull(AuditRuleMatched) AND isnull(pkg_transaction_id)
| table _time host file_path file_hash file_perms
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in ("passwd", "shadow") or (AdditionalFields has "suid" and ActionType == "FileModified")
| join kind=leftanti (SecurityEvent | where EventID == 1804) on $left.SHA256 == $right.SHA256
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName, SHA256
```

### Sigma

```yaml
title: RefluXFS Silent /etc/passwd or SUID-Root Binary Modification With No Preceding Audit Entry
id: 3d4e5f6a-7b8c-49d0-a1e2-refluxfsafp
status: experimental
description: Detects modification of /etc/passwd, /etc/shadow, or a SUID-root binary with no corresponding audit-log or package-manager transaction, the anti-forensic pattern left by a successful RefluXFS (CVE-2026-64600) stale-block-reuse overwrite that grants passwordless root without a kernel crash or LSM denial.
references:
    - https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.defense-evasion
    - attack.t1070
    - attack.t1222.002
    - attack.t1565
    - cve.2026.64600
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '/etc/passwd'
            - '/etc/shadow'
    filter_expected_audit:
        AuditRuleMatched: true
    filter_pkg_txn:
        PackageManagerTransaction: true
    condition: selection and not filter_expected_audit and not filter_pkg_txn
falsepositives:
    - Sanctioned config-management (Ansible/Puppet/Chef) runs executed without audit-rule coverage or package manager transactions
level: critical
```

**Known false positives:**

- Sanctioned config-management (Ansible/Puppet/Chef) runs executed outside audit-rule coverage or package-manager transaction tracking

**Tuning notes:** Correlate against a config-management change-window allowlist (e.g. Ansible run IDs) before alerting, and require the file-integrity monitor to be actively baselined on the host to avoid missed-baseline false positives.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RefluXFS Reflink Clone of Sensitive File (Exploitation Precondition) — Sentinel (locked: unlock with TL Creds)
- RefluXFS Concurrent O_DIRECT Writers Against Same File (Race Trigger) — Sentinel (locked: unlock with TL Creds)
- RefluXFS Unauthorized Root Account Creation in [indicator] (Post-Exploitation Persistence) — Sentinel (locked: unlock with TL Creds)
- RefluXFS Reflink Clone Precondition Chain (Sigma) (locked: unlock with TL Creds)
- RefluXFS SUID-Root Binary Tamper Without Package-Manager Transaction (Sigma) (locked: unlock with TL Creds)
- RefluXFS Post-Exploitation Root Shell Spawn From Recently-Tampered Binary Path (C2/Lateral-Movement Equivalent) (locked: unlock with TL Creds)
- RefluXFS Reflink Clone of Sensitive File (Exploitation Precondition) (locked: unlock with TL Creds)
- RefluXFS Concurrent O_DIRECT Writers Against Same Reflinked Inode (Race Trigger) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 60)

Defanged, TLP:CLEAR.

- File hash: `2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7`
- File hash: `206c09b04dc5469c7ff14d8aceff2d47c88078d9`
- File hash: `44f891bc088958399eec27f7604928694aa35581`

Full set of 60 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)](https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600)
- [Linux Kernel Local Privilege Escalation Vulnerability Exploited in Attacks (Fragnesia) (CVE-2026-46300)](https://threatprotect.qualys.com/2026/05/15/linux-kernel-local-privilege-escalation-vulnerability-exploited-in-attacks-fragnesia-cve-2026-46300/)
- [pedit COW (CVE-2026-46331): Mitigation and Kernel Update on CloudLinux](https://blog.cloudlinux.com/pedit-cow-mitigation-and-kernel-update)
- [pedit-cow (CVE-2026-46331): Linux tc Flaw Grants Root](https://tuxcare.com/blog/pedit-cow-cve/)
- [CVE-2026-46300 (Fragnesia) Reference](https://www.tenable.com/cve/CVE-2026-46300)
- [CVE-2026-64600 (RefluXFS) — NVD Record (RESERVED, not yet populated)](https://nvd.nist.gov/vuln/detail/CVE-2026-64600)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-64600 not listed as of 2026-07-22)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1629