Ethical Hacking News
The RefluXFS Linux vulnerability discloses a critical flaw that allows an unprivileged local user to gain persistent root access by overwriting root-owned files on an XFS filesystem. System administrators are advised to ensure their systems are up-to-date with the latest security patches and apply vendor updates as soon as they become available, to prevent exploitation of this previously unknown vulnerability.
RefluXFS Linux kernel vulnerability (CVE-2026-64600) allows unprivileged local users to gain persistent root access by overwriting root-owned files on an XFS filesystem. The vulnerability relies on three conditions: a system running Linux 4.11 or later without the fix, an XFS filesystem created with reflink=1, and shared filesystem between readable target and attacker-writable directory. Patching exposed systems is advised, including multi-tenant systems where untrusted code can run locally, due to no practical mitigation or temporary configuration change available. Default installations vulnerable include Red Hat Enterprise Linux, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux and CloudLinux 8, 9 and 10, Fedora Server 31 and later, Amazon Linux 2023 and Amazon Linux 2 images from December 2022 onward. RHEL 7 filesystems are not affected due to earlier support of XFS reflink. Debian, Ubuntu, SLES, and openSUSE may be vulnerable if an administrator chose XFS with reflink enabled at install time.
The cybersecurity landscape has been abuzz with the recent disclosure of a critical vulnerability in the Linux kernel, namely RefluXFS. This flaw, tracked as CVE-2026-64600, poses a significant threat to system administrators, particularly those who manage systems running Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux.
According to Qualys, an AI model was used to identify this vulnerability, which allows an unprivileged local user to overwrite root-owned files on an XFS filesystem, thereby gaining persistent root access. This exploit relies on three conditions:
1. The system must be running a version of Linux 4.11 or later without the RefluXFS fix applied.
2. The XFS filesystem used by the system was created with reflink=1.
3. The readable target and an attacker-writable directory must share the same XFS filesystem.
Qualys has advised that patching exposed systems first is advisable, which includes multi-tenant systems where untrusted code can run locally. Researchers at Qualys noted that no practical mitigation or temporary configuration change is available to prevent this vulnerability, as it lies in the block-layer write and not memory corruption, where other security measures like SELinux in Enforcing mode, seccomp, kernel lockdown, and container boundaries fail to stop it.
The advisory listed default installations that can meet those conditions, including Red Hat Enterprise Linux, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux and CloudLinux 8, 9 and 10, Fedora Server 31 and later, Amazon Linux 2023, and Amazon Linux 2 images from December 2022 onward. However, RHEL 7 filesystems are not affected due to the earlier support of XFS reflink.
Researchers noted that Debian, Ubuntu, SLES, and openSUSE do not generally use XFS for the root filesystem by default but are exposed only if an administrator chose XFS with reflink enabled at install time. A check can be done using the command xfs_info / | grep reflink=1 to confirm whether a system is vulnerable. Further testing revealed that Debian's tracker listed the fix in trixie-security as kernel 6.12.96-1 and in unstable as 7.1.4-1, but Trixie's base kernel 6.12.94-1 and forky's 7.1.3-1 were still marked vulnerable.
The researchers also stated that the race only fires if the target's block starts unshared, which means a file an administrator already reflink-copied cannot be hit, but an unprivileged user can reset that condition by running the command chsh and setuid-root binaries are unlikely to have been reflinked in the first place.
Qualys published no standalone exploit code for this vulnerability; instead, Red Hat's tracker logged a public proof-of-concept on July 22, pointing at the advisory posted to the oss-security list. The company further noted that researchers used the Claude Mythos Preview model, Anthropic's restricted-access frontier model, which found the flaw and provided a working root exploit.
The discovery of this vulnerability serves as a reminder for system administrators to ensure their systems are up-to-date with the latest security patches and to remain vigilant against such vulnerabilities. Red Hat has issued Important-rated kernel advisories across affected RHEL 8, 9, and 10 streams, starting on July 14, eight days before coordinated disclosure.
The RefluXFS Linux vulnerability discloses a critical flaw that allows an unprivileged local user to gain persistent root access by overwriting root-owned files on an XFS filesystem. System administrators are advised to ensure their systems are up-to-date with the latest security patches and apply vendor updates as soon as they become available, to prevent exploitation of this previously unknown vulnerability.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Critical-Linux-Vulnerability-The-RefluXFS-Flaw-and-Its-Implications-for-System-Administrators-ehn.shtml
https://thehackernews.com/2026/07/nine-year-old-refluxfs-linux-flaw-gives.html
Published: Thu Jul 23 05:35:51 2026 by llama3.2 3B Q4_K_M
