RefluXFS - Root privilege escalation in the Linux kernel via XFS (CVE-2026-64600)

A severe vulnerability has been identified in the Linux kernel under the reference CVE-2026-64600, dubbed RefluXFS by Qualys researchers. It allows a local unprivileged user to gain root access on any system running the XFS filesystem with the reflink option enabled. Changes made through exploitation survive reboots and generate no kernel log entries.

Technical details

The flaw lies in the copy-on-write (CoW) path of the XFS filesystem when the reflink=1 option is active. A race condition in this path allows a local attacker to replace the on-disk content of any readable file on the affected XFS volume - including system binaries such as /usr/bin/sudo or /etc/passwd.

What makes RefluXFS particularly serious:

• Persistence: changes survive reboots, unlike purely memory-based exploits
• Silence: no kernel log entries are generated during exploitation
• Age: the flaw has been present since kernel v4.11 (2017)
• Scope: any distribution using XFS with reflink enabled is exposed, which includes the entire Red Hat ecosystem by default

Affected systems

The reflink=1 option is enabled by default in the Red Hat ecosystem when creating an XFS volume.

Actions to take

1. Update the kernel (priority action)

Patches are available and being backported to enterprise distributions. Apply kernel updates through your distribution’s standard channels, then reboot the system - a full reboot is mandatory for the fix to take effect.

2. Check whether your XFS volume is exposed

xfs_info / | grep reflink

If the output contains reflink=1, the volume is affected.

3. Temporary mitigation

If the patch cannot be applied immediately and reflink is not functionally required, recreate the volume without the option (destructive operation - requires a prior backup):

mkfs.xfs -m reflink=0 /dev/sdX

This option cannot be disabled on an existing live volume.

Heavy Mind managed IT clients

Servers under Heavy Mind managed IT contracts received immediate attention. XFS volumes with reflink enabled have been audited across all environments, and patches are being deployed with scheduled reboots. No action is required on your part.

Not a managed IT client?

We can assist you with this vulnerability - and beyond. Heavy Mind offers:

• Linux server audit: verification of exposed filesystems, attack surface analysis and kernel patch status
• Patch deployment: controlled rollout with regression testing and scheduled reboot
• Monitoring setup: proactive detection of future critical vulnerabilities across your infrastructure

Source: Qualys Threat Research Unit - RefluXFS (CVE-2026-64600)