TLDR Tech / InfoSec
RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)
CVE-2026-64600 is a race condition in the Linux kernel's XFS copy-on-write path where two concurrent O_DIRECT writes to a reflinked file cause the kernel to re-check a stale block reference count after dropping its inode lock, letting an unprivileged local user overwrite any readable file (such as /etc/passwd or a SUID-root binary) directly at the block layer with no kernel log output and persistence across reboots. The flaw affects any kernel since v4.11 (2017) with XFS reflink=1, hitting default installs of RHEL, Oracle Linux, Amazon Linux, and Fedora (an estimated 16.4 million systems), and standard defenses including KASLR, SMEP, SMAP, SELinux enforcing, seccomp, and container isolation all fail to stop it since the flaw sits below their reach at the filesystem allocation layer. Apply vendor kernel patches immediately and reboot to confirm remediation, prioritizing internet-facing and multi-tenant systems first.
Read the full story