DEV Community

Jalaldeen Muhammathu Shakeel
Jalaldeen Muhammathu Shakeel

Posted on

RefluXFS (CVE-2026-64600): A Deep Dive into the Linux XFS Vulnerability That Lets Local Users Become Root

#linux #vulnerabilities #kernal #hacked

TL;DR: RefluXFS (CVE-2026-64600) is a critical local privilege escalation vulnerability affecting the Linux kernel's XFS filesystem. By exploiting a race condition in the reflink copy-on-write path, an unprivileged user can overwrite protected files and gain persistent root access. If you're running RHEL 8/9/10, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux, or Fedora Server with XFS reflink enabled, update your kernel immediately.

What Happened?

On July 22, 2026, the Qualys Threat Research Unit disclosed CVE-2026-64600, nicknamed RefluXFS.

Unlike many Linux privilege escalation vulnerabilities that rely on memory corruption or kernel exploits, RefluXFS abuses a flaw in the XFS filesystem itself.

The vulnerability has existed since Linux kernel 4.11 (2017) and affects systems using XFS with reflink enabled, which is the default configuration for several enterprise Linux distributions.

According to the disclosure, approximately 16.4 million systems may be affected.

Understanding XFS Reflink

XFS supports a feature called reflink, which creates lightweight copies of files using Copy-on-Write (CoW).

Instead of duplicating every block immediately, both the original file and its clone reference the same physical blocks on disk.

For example:

cp --reflink=always database.img backup.img
Enter fullscreen mode Exit fullscreen mode

Initially, both files share the same storage.

Original File
      │
      ▼
Shared Physical Blocks
      ▲
      │
Clone File
Enter fullscreen mode Exit fullscreen mode

When one of the files is modified, XFS allocates new blocks only for the changed data while the remaining blocks continue to be shared.

This approach provides several advantages:

  • Faster file copies
  • Lower disk usage
  • Reduced SSD wear
  • Efficient snapshots and backups

Where the Vulnerability Exists

The vulnerability exists inside XFS's reflink copy-on-write implementation.

When multiple O_DIRECT write operations occur simultaneously against a reflinked clone, XFS can reuse an outdated extent mapping.

Instead of writing to the clone's newly allocated blocks, the filesystem mistakenly writes to blocks belonging to the original protected file.

Expected behavior:

Clone File
      │
      ▼
Clone Blocks
Enter fullscreen mode Exit fullscreen mode

Vulnerable behavior:

Clone File
      │
      ▼
Protected File Blocks
Enter fullscreen mode Exit fullscreen mode

The kernel believes the write completed successfully.

The problem is that it reached the wrong destination.

Simplified Attack Flow 

Protected File
      │
      ▼
Attacker creates reflink clone
      │
      ▼
Concurrent O_DIRECT writes
      │
      ▼
Race condition occurs
      │
      ▼
Stale extent mapping reused
      │
      ▼
Protected file modified
      │
      ▼
Root privilege escalation
Enter fullscreen mode Exit fullscreen mode

Why File Permissions Don't Help

Linux checks file permissions before writing data.

Normal flow:

User
  │
  ▼
Permission Check
  │
  ▼
Filesystem
  │
  ▼
Disk
Enter fullscreen mode Exit fullscreen mode

With RefluXFS:

Permission Check
       │
       ▼
Filesystem starts write
       │
       ▼
Race condition
       │
       ▼
Wrong physical block updated
Enter fullscreen mode Exit fullscreen mode

Because permission checks have already succeeded, the kernel never realizes the write was redirected to another file.

Why O_DIRECT Matters

Most applications write through the Linux page cache.

Application
      │
      ▼
Page Cache
      │
      ▼
Filesystem
      │
      ▼
Disk
Enter fullscreen mode Exit fullscreen mode

The exploit specifically abuses O_DIRECT, which bypasses the page cache.

Application
      │
      ▼
Filesystem
      │
      ▼
Disk
Enter fullscreen mode Exit fullscreen mode

By interacting directly with filesystem metadata, carefully timed concurrent writes can trigger the race condition.

Why This Vulnerability Is So Dangerous

Unlike traditional privilege escalation bugs, RefluXFS does not require:

  • Kernel memory corruption
  • Buffer overflows
  • Arbitrary code execution in kernel space
  • Return-oriented programming (ROP)

Instead, it abuses a logic flaw inside the filesystem.

No Metadata Changes

Only the file contents change.

Ownership remains unchanged.

-rw-r--r--
root root
Enter fullscreen mode Exit fullscreen mode

Permissions also remain unchanged.

No Kernel Panic

The kernel doesn't crash.

There are no:

  • Kernel oops
  • Panic messages
  • Stack traces
  • Memory corruption warnings

Everything appears normal.

Persistent Root Access

Attackers can overwrite files such as:

/etc/passwd

/etc/shadow

setuid binaries

~/.ssh/authorized_keys

systemd service files
Enter fullscreen mode Exit fullscreen mode

Because the changes are written to disk, they survive reboots.

SELinux Doesn't Stop It

SELinux authorizes the original write operation.

The race condition changes where the data is written after authorization.

As a result, SELinux sees nothing suspicious.

KASLR Doesn't Help

Kernel Address Space Layout Randomization (KASLR) protects kernel memory.

RefluXFS never attacks kernel memory.

It targets filesystem block mappings instead.

Who Is Affected?

Systems are vulnerable if all of the following conditions are met:

  • Running a vulnerable Linux kernel
  • Using the XFS filesystem
  • Reflink support is enabled (reflink=1)
  • An attacker has local code execution

Affected distributions include:

  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux 10
  • AlmaLinux
  • Rocky Linux
  • Oracle Linux
  • Amazon Linux
  • Fedora Server

Systems using ext4 are generally not affected by this vulnerability.

Red Hat Advisory

Red Hat confirmed that RHEL 8, RHEL 9, and RHEL 10 are affected when XFS with reflink enabled is used.

According to Red Hat, there is no supported workaround.

The recommended mitigation is to install the latest kernel update provided by Red Hat and reboot the system so the patched kernel becomes active.

Official advisory:

https://access.redhat.com/solutions/7145752

How to Check Your System

Check the running kernel 

uname -r
Enter fullscreen mode Exit fullscreen mode

Check the filesystem type 

df -T
Enter fullscreen mode Exit fullscreen mode

Example:

Filesystem     Type
/dev/sda2      xfs
Enter fullscreen mode Exit fullscreen mode

Check if reflink is enabled 

xfs_info /
Enter fullscreen mode Exit fullscreen mode

Look for:

reflink=1
Enter fullscreen mode Exit fullscreen mode

If your system is running a vulnerable kernel with XFS and reflink=1, it should be updated immediately.

Updating RHEL

Update your packages:

sudo dnf update
Enter fullscreen mode Exit fullscreen mode

or

sudo yum update
Enter fullscreen mode Exit fullscreen mode

After installation:

sudo reboot
Enter fullscreen mode Exit fullscreen mode

Verify the active kernel:

uname -r
Enter fullscreen mode Exit fullscreen mode

Installing a new kernel package without rebooting does not protect the running system.

Detecting Potential Exploitation

Because RefluXFS modifies data rather than metadata, detection can be difficult.

Administrators should monitor for:

  • Unexpected changes to /etc/passwd or /etc/shadow
  • Modified setuid binaries
  • Unauthorized SSH keys
  • File integrity monitoring alerts (AIDE, Tripwire, etc.)
  • Unexpected privilege escalation events
  • Kernel versions known to be vulnerable

Since the exploit leaves few obvious traces, proactive monitoring becomes especially important.

Is There a Workaround?

No.

The following do not mitigate the vulnerability:

  • Disabling SELinux
  • AppArmor policy changes
  • Modifying file permissions
  • Restricting sudo
  • Restarting services

The only effective mitigation is installing a vendor-patched kernel and rebooting into it.

Administrator Checklist

  • [ ] Install the latest vendor kernel update
  • [ ] Reboot into the patched kernel
  • [ ] Verify the running kernel with uname -r
  • [ ] Confirm whether XFS with reflink=1 is in use
  • [ ] Review file integrity monitoring alerts
  • [ ] Audit privileged file modifications
  • [ ] Ensure all production and staging systems have been updated

Final Thoughts

RefluXFS (CVE-2026-64600) is a reminder that not every critical Linux vulnerability comes from memory corruption. Modern filesystems have evolved to include advanced features such as copy-on-write, reflinks, snapshots, and direct I/O. While these features improve performance and storage efficiency, they also introduce complex synchronization challenges that can have serious security implications.

By exploiting a race condition in XFS's reflink implementation, an unprivileged local user can overwrite protected files and gain persistent root access without triggering many of the traditional indicators associated with kernel exploits. Because there is no supported workaround, applying your vendor's patched kernel and rebooting should be treated as a high-priority security update.

References

Have you checked whether your Linux servers are using XFS with reflink enabled? Share your thoughts or mitigation strategy in the comments.

#linux #cybersecurity #kernel #opensource #devops #redhat #rhel #xfs #infosec #linuxkernel

Top comments (0)