A local user with zero admin rights. A race condition hiding in the Linux kernel since 2017. Within seconds — full, passwordless root access, with no log trail left behind.
That's RefluXFS (CVE-2026-64600), a newly disclosed race condition in the XFS filesystem's copy-on-write path, discovered by the Qualys Threat Research Unit.
Why it matters for engineers and SOC teams:
- Grants root access to unprivileged local users
- Leaves zero kernel log artifacts
- Survives reboots — the corrupted file's metadata (ownership, permissions, setuid bit) stays untouched
- Bypasses SELinux (Enforcing mode), container isolation, and kernel hardening like KASLR/SMEP/SMAP entirely
- Affects 16.4M+ systems: RHEL, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, Amazon Linux
Exploitable when three conditions align: an unpatched kernel (v4.11+), XFS with reflink=1 enabled, and a writable directory near a high-value target like a SUID-root binary.
I put together a full technical breakdown — the race condition mechanics, exposure-check commands (uname -r, xfs_info), detection strategy for SOC teams, and patch steps — in the full write-up below.
👉 Full breakdown: https://www.xpert4cyber.com/2026/07/refluxfs-linux-kernel-vulnerability-root-access.html
Top comments (0)