Listen to this Post
CVE-2026-64600, dubbed “RefluXFS,” is a local privilege escalation vulnerability in the Linux kernel’s XFS filesystem. Discovered by Qualys Threat Research Unit and publicly disclosed on July 22, 2026, this flaw stems from a race condition in the copy-on-write (CoW) mechanism for reflinked files. The vulnerability has been present in every Linux kernel since version 4.11, released in April 2017, meaning it has existed for approximately nine years.
The core issue lies within the functions `xfs_reflink_fill_cow_hole` and `xfs_reflink_fill_delalloc` in the `fs/xfs/xfs_reflink.c` file. These functions are responsible for handling CoW operations during direct I/O writes. A race condition occurs because these helpers cycle the inode lock (ILOCK) to obtain a transaction. The data fork mapping and CoW fork mapping become stale the moment the ILOCK is reacquired. While the CoW fork mapping is refreshed, the data fork mapping is not. This leads `xfs_bmap_trim_cow` to query the refcount btree using incorrect physical block information, potentially returning an inaccurate `shared` value. If `shared` is incorrectly reported as false, the direct I/O write proceeds with a stale data fork mapping, allowing a write to modify the original shared data block directly instead of the newly allocated CoW block. This bypasses the copy-on-write process and enables an unprivileged local user to overwrite root-owned or protected files on an XFS filesystem, leading to full root access. The vulnerability is highly reliable, leaves no kernel log output, and is estimated to affect over 16.4 million systems.
DailyCVE Form:
Platform: Linux Kernel
Version: 4.11 through 6.12.95 / 6.18.38 / 7.1.3 / 7.2-rc3
Vulnerability: Race Condition (CWE-362)
Severity: High (CVSS 7.8)
Date: 2026-07-23
Prediction: Patch available since 2026-07-16
What Undercode Say:
Analytics and technical insights regarding CVE-2026-64600.
Check Kernel Version:
uname -r
Check if XFS with reflink is enabled:
mount | grep xfs | grep -o "reflink"
View the vulnerable code path (for reference):
grep -n "xfs_reflink_fill_cow_hole" /path/to/linux-source/fs/xfs/xfs_reflink.c grep -n "xfs_reflink_fill_delalloc" /path/to/linux-source/fs/xfs/xfs_reflink.c
Identify the fixing commit:
git log --oneline --grep="CVE-2026-64600" git show e705d81a7193dd19e69b8e2bad4696d78a4ea075
Check for available patches (RHEL example):
yum update kernel rpm -q --changelog kernel | grep -i CVE-2026-64600
Exploit: (Educational Purposes!)
No public exploit code has been released for this vulnerability. However, the exploitation vector is local access. An unprivileged user with read access to a target file can create a reflink clone under a writable directory on the same XFS filesystem. By racing two concurrent direct I/O writes on the reflink file, the attacker can trigger the race condition, causing the kernel to modify the original file’s data blocks directly. This allows overwriting protected system files, such as `/etc/passwd` or other root-owned files, leading to privilege escalation. Proof-of-concept (PoC) exploit code is believed to exist.
Protection:
The primary and only reliable mitigation is to apply the kernel patch. The vulnerability is fixed in the following Linux kernel versions:
– 6.12.96 (commit e705d81a7193dd19e69b8e2bad4696d78a4ea075)
– 6.18.39 (commit 206c09b04dc5469c7ff14d8aceff2d47c88078d9)
– 7.1.4 (commit 44f891bc088958399eec27f7604928694aa35581)
– 7.2-rc4 (commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7)
System administrators should update to the latest stable kernel version provided by their Linux distribution. Affected distributions include RHEL 8/9/10, CentOS Stream 8/9/10, Oracle Linux 8/9/10, Rocky Linux, AlmaLinux, CloudLinux, SUSE, Ubuntu, and Debian. Red Hat has released security advisories (RHSA-2026:48016, RHSA-2026:46951) with backported patches. SUSE and Ubuntu have also released fixed kernel versions. For systems where immediate rebooting is not possible, live patching solutions like KernelCare may offer a temporary mitigation.
Impact:
Successful exploitation of this vulnerability allows an unprivileged local user to gain full root privileges on the affected system. The attacker can overwrite any readable file on the XFS volume at the block layer. The changes are made directly on disk, persist across reboots, and produce no kernel log output, making the attack difficult to detect. This poses a critical risk, especially in multi-tenant environments like shared hosting, where a single compromised web application could lead to a full server compromise. The vulnerability is estimated to affect over 16.4 million systems, primarily enterprise Linux deployments that use XFS with reflink enabled by default. No temporary mitigation, including SELinux in enforcing mode, is considered reliable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
