RefluXFS: A Critical Linux Kernel Flaw Exposes XFS Filesystems to Root-Level Compromise

A newly disclosed Linux kernel vulnerability, dubbed RefluXFS and tracked as CVE-2026-64600, presents a significant threat to systems utilizing the XFS filesystem. Discovered on July 22, 2026, this flaw allows an unprivileged local user to overwrite critical root-owned files, paving the way for persistent root access. The vulnerability stems from a race condition within the XFS filesystem’s reflink functionality, a feature that enables efficient file copying through block-level sharing.

The implications of RefluXFS are far-reaching, particularly for default installations of popular Linux distributions such as Red Hat Enterprise Linux (RHEL) and its derivatives, including Fedora Server and Amazon Linux. Qualys, the cybersecurity firm that identified and reported the vulnerability, demonstrated how an attacker could exploit this flaw to target sensitive files like /etc/passwd and setuid-root binaries. Crucially, the overwrite operation is designed to bypass standard file ownership and permission checks, ensuring that modified binaries retain their elevated privileges even after a system reboot.

The discovery and subsequent patching of RefluXFS highlight the evolving landscape of kernel security and the increasing role of artificial intelligence in vulnerability research. Anthropic’s Claude Mythos Preview, an advanced AI model, is credited with identifying the race condition and even generating a working root exploit and an initial advisory. This marks a significant milestone in AI-assisted cybersecurity, showcasing its potential to uncover complex, low-level vulnerabilities.

Understanding the RefluXFS Vulnerability: A Technical Deep Dive

At its core, RefluXFS exploits a subtle flaw in how XFS handles copy-on-write (COW) operations when using the reflink feature. Reflinking allows multiple files to share identical data blocks on disk, only creating new copies when a modification occurs. This is achieved through a mechanism where the filesystem tracks data block mappings.

The vulnerability arises during a specific sequence of operations:

1. Cloning and Initial Mapping: An unprivileged attacker first clones a root-owned file into a temporary "scratch" file. This cloning operation, utilizing the FICLONE system call, requires only read access to the original file. Initially, both the original and the cloned file point to the same physical disk blocks.
2. The Race Window: The critical vulnerability occurs when concurrent O_DIRECT write operations are performed on the cloned file. The kernel, in its process of handling these writes, enters a critical section where it reads the data-fork mapping under an inode lock. It then calls xfs_reflink_fill_cow_hole(), which temporarily releases this lock to reserve transaction space.
3. Copy-on-Write Hijacking: During this brief window when the lock is released, a second writer can complete its copy-on-write operation. This means the cloned file’s mapping is updated to point to a new set of disk blocks, effectively decoupling it from the original file’s data.
4. Stale Mapping Exploitation: When the first writer reacquires the inode lock, it attempts to refresh the copy-on-write fork. However, because the lock was held for a period and then reacquired, the data-fork mapping it is working with is now "stale." It continues to point to the old, shared data blocks.
5. Overwriting Root-Owned Data: The XFS filesystem, unaware of the remapping that occurred during the race, perceives these shared blocks as no longer being exclusively referenced by the original protected file. It then permits the direct write operation from the attacker’s cloned file to proceed, but because the mapping is stale, the data intended for the clone is instead written to the original root-owned file.

This "check-then-use" error, occurring across a lock cycle, means that while the initial check for shared blocks might be accurate at the time it’s performed, the address it uses becomes outdated before the write operation is finalized. The use of Direct I/O further exacerbates the problem, as it bypasses the page cache and its revalidation mechanisms, allowing the data to be written directly to disk without further scrutiny. Consequently, the target file’s metadata remains unchanged, and the system may not log any warnings or errors.

Timeline of Discovery and Mitigation

The vulnerability’s roots trace back to Linux kernel version 4.11, released in 2017. The commit that introduced the problematic code is identified as 3c68d44a2b49. This suggests that the flaw has existed for approximately nine years before its public disclosure.

• circa 2017: The introduction of the code that would later become the RefluXFS vulnerability in Linux kernel 4.11.
• Early 2026: AI model Claude Mythos Preview identifies the vulnerability and generates an exploit.
• July 10, 2026: Red Hat’s bug tracker logs the flaw as "kernel: XFS data corruption using reflink" after auto-import.
• July 14, 2026: Red Hat begins issuing kernel advisories (RHSA-2026:39179, RHSA-2026:39180 for RHEL 8; RHSA-2026:39494 for RHEL 10) to mitigate the vulnerability, days before public disclosure.
• July 16, 2026: The official fix for the RefluXFS vulnerability is merged into the Linux kernel.
• July 17, 2026: Red Hat continues to release advisories for extended-support and SAP streams.
• July 22, 2026: Qualys publicly discloses RefluXFS (CVE-2026-64600) and publishes its technical advisory.
• July 22, 2026: A public proof-of-concept is posted to the oss-security mailing list, detailing the race condition and exploitation steps.
• July 23, 2026: Debian’s security tracker indicates the fix is present in its Trixie and Unstable branches, with older branches still marked as vulnerable.

The patching process has been initiated by major Linux vendors. Red Hat, a key player in the enterprise Linux space, has already released "Important-rated" kernel advisories for RHEL 8, 9, and 10 streams. These errata, which began appearing on July 14, provided coverage for affected systems even before the vulnerability was publicly named. Other distributions are also working to integrate the fix into their respective kernels.

Systems at Risk: Identifying Vulnerable Configurations

The RefluXFS vulnerability is not a universal threat to all Linux systems. Exploitation requires the confluence of three specific conditions:

1. XFS Filesystem Usage: The system must be using the XFS filesystem. While XFS is a robust and widely adopted filesystem, it is not the default for all Linux distributions.
2. Reflink Feature Enabled: The XFS filesystem must have the reflink feature enabled. This is typically enabled by default on newer installations of certain distributions.
3. Untrusted Code Execution: An unprivileged local user must be able to execute untrusted code on the system. This could be achieved through various means, such as a compromised service, a misconfigured container, or direct shell access.

Qualys has identified specific default installations that are susceptible to exploitation:

• Red Hat Enterprise Linux (RHEL) and its derivatives: RHEL 8, 9, and 10, along with CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, and CloudLinux 8, 9, and 10.
• Fedora Server: Versions 31 and later.
• Amazon Linux: Amazon Linux 2023 and Amazon Linux 2 images released from December 2022 onwards.

It’s important to note that RHEL 7 systems are not affected because their XFS filesystems predate the widespread adoption of reflink support.

Distributions like Debian, Ubuntu, SUSE Linux Enterprise Server (SLES), and openSUSE are generally not affected by default because they typically do not use XFS as their root filesystem. However, administrators who intentionally configured XFS with reflink enabled on these systems could still be vulnerable.

To check if your root filesystem meets the conditions, administrators can run the following command:

xfs_info / | grep reflink=

If the output shows reflink=1, it indicates that the reflink feature is enabled and the second condition for exploitation is met. A similar check should be performed on any other mounted XFS volumes where a protected file and an attacker-writable directory reside on the same filesystem.

The Role of AI in Vulnerability Discovery

The discovery of RefluXFS by an AI model represents a significant advancement in the field of cybersecurity. Anthropic’s Claude Mythos Preview, a cutting-edge large language model, was tasked with finding vulnerabilities similar to the infamous "Dirty COW" (CVE-2016-5195) in the Linux kernel. The AI not only pinpointed the race condition within XFS but also generated a functional root exploit and drafted a detailed technical advisory.

This event underscores the growing capability of AI to analyze complex codebases and identify intricate security flaws that might be missed by human researchers. While human oversight and validation remain crucial, AI-powered tools are poised to become indispensable assets in the ongoing battle against cyber threats. Qualys researchers were able to reproduce the AI’s findings, verify its reasoning, and coordinate responsible disclosure with upstream developers.

This is not the first time Qualys has uncovered older kernel bugs this year. In a separate incident, they disclosed a snap-confine flaw in Ubuntu Desktop (CVE-2026-8933) that also allowed local privilege escalation. Prior to that, in May 2026, Qualys identified a nine-year-old bug in the kernel’s ptrace checks, highlighting a recurring theme of long-standing, yet critical, vulnerabilities being unearthed.

Broader Implications and Mitigation Strategies

The RefluXFS vulnerability has several critical implications for system security. The fact that the overwrite occurs at the block layer and bypasses standard metadata checks means that traditional security mechanisms like SELinux in enforcing mode, seccomp, kernel lockdown, and even container boundaries proved ineffective during Qualys’s testing. Memory protection techniques such as KASLR (Kernel Address Space Layout Randomization) and SMEP (Supervisor Mode Execution Prevention) are also irrelevant here, as the vulnerability does not involve memory corruption.

A key mitigating factor is that the race condition only triggers if the target block is initially unshared. This means that files that have already undergone a reflink copy operation by an administrator cannot be directly targeted by this specific exploit. Furthermore, setuid-root binaries, which are often not reflinked due to their critical nature, are less likely to be affected by this particular attack vector.

However, the ease with which an unprivileged user can initiate the overwrite and the survival of the exploit across reboots present a substantial risk. The primary recommendation for affected organizations is to apply the vendor-provided patches as soon as possible. For Red Hat systems, this means installing the relevant kernel advisories. It is crucial to understand that installing a package does not update the running kernel in memory. Therefore, after applying the update, a system reboot is mandatory to ensure the patched kernel is loaded and active.

There is currently no mount option or sysctl parameter that can disable XFS reflinks once a filesystem has been created, making a system reboot and kernel update the only reliable solutions.

Official Responses and Vendor Actions

The cybersecurity community has responded swiftly to the disclosure of RefluXFS. Red Hat, a major vendor whose distributions are directly impacted, has taken proactive steps. Their security advisories, released prior to the public disclosure, indicate a strong commitment to addressing critical vulnerabilities. The bug tracker entry for this flaw, titled "kernel: XFS data corruption using reflink," was auto-imported on July 10, 2026, underscoring the early awareness within their security team.

Other distributions are also working to integrate the patch. As of July 23, 2026, Debian’s security tracker indicated the fix was present in its Trixie and Unstable branches, with kernels like 6.12.96-1 for Trixie and 7.1.4-1 for Unstable containing the necessary corrections. Older Debian branches, including Bookworm and Bullseye, remained marked as vulnerable, necessitating updates to their respective security branches.

Qualys has emphasized the importance of prioritizing patching for exposed and multi-tenant systems. This includes any XFS host with reflink enabled where untrusted code can be executed locally, whether through a web shell, a CI/CD pipeline, or a compromised background service.

While Qualys did not release standalone exploit code, the existence of a public proof-of-concept, detailed on the oss-security mailing list, provides clear instructions on how to exploit the vulnerability. As of the time of reporting, no exploitation in the wild had been confirmed by vendors tracking the flaw.

The discovery of RefluXFS serves as a stark reminder of the ongoing challenges in maintaining kernel security. As systems become more complex and the attack surface expands, vulnerabilities that have lain dormant for years can be unearthed, often with the assistance of advanced technologies like AI. Continuous vigilance, prompt patching, and a thorough understanding of system configurations remain paramount in safeguarding against such threats.