RefluXFS Linux kernel flaw grants root access on XFS systems

Security researchers at Qualys disclosed a Linux kernel vulnerability dubbed RefluXFS (CVE‑2026‑64600) that affects kernels from version 4.11 onward. The race‑condition occurs on XFS filesystems with the reflink (copy‑on‑write) feature enabled. By exploiting the flaw through the FICLONE system call and concurrent O_DIRECT writes, a local user can overwrite any readable file—including critical system files such as /etc/passwd or setuid binaries—without kernel warnings, effectively gaining root privileges.

The vulnerability impacts standard installations of distributions that use XFS on the root partition with reflink enabled, including Red Hat Enterprise Linux (8+), Fedora Server (31+), Amazon Linux 2023, CentOS Stream, Oracle Linux, Rocky Linux and AlmaLinux. Distributions that default to other filesystems for the system partition, such as Debian, Ubuntu and openSUSE, are not affected. The flaw was identified with the assistance of Anthropic’s Claude Mythos Preview AI model as part of the Glasswing project.

Upstream patches were merged on 16 July 2026, and updated kernel packages have been released by vendors such as Red Hat and Debian. No configuration‑based work‑arounds (sysctl or mount options) exist; systems must apply the updated kernel to remediate the issue.