Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

RefluXFS is a nine-year-old Linux kernel vulnerability (CVE-2026-64600) affecting XFS filesystems with reflink enabled, allowing unprivileged local users to escalate privileges to root by exploiting a race condition in copy-on-write operations. The flaw impacts default installations of Red Hat Enterprise Linux, Fedora Server, Amazon Linux, and related distributions. Exploitation modifies root-owned files like /etc/passwd or setuid binaries without altering metadata, making detection difficult. The vulnerability was discovered using an AI model, which also generated a working exploit and advisory.

AI-extracted · verify before operational use