RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)

Key Points:

• CVE-2026-64600 is a critical local privilege escalation vulnerability in the Linux kernel's XFS filesystem, allowing unprivileged users to gain root access by exploiting a race condition.
• The vulnerability affects any Linux distribution with an XFS root filesystem using reflink enabled, potentially impacting over 16.4 million systems globally, including major enterprise platforms like RHEL and Oracle Linux.
• Immediate kernel patching is essential, as there are no effective mitigations available. Affected organizations should prioritize updates and reboots to secure their systems.

Technical Details: The vulnerability exploits a race condition in the copy-on-write path of the XFS filesystem, allowing an ordinary user to overwrite protected files and gain root privileges without leaving kernel log traces. It has existed since kernel version 4.11.

MITRE ATT&CK Techniques:

• T1068 - Exploit Public-Facing Application (Privilege Escalation)

IOCs Mentioned: None mentioned.