Linux kernel flaw lets any local user silently gain root access

A newly disclosed vulnerability in the Linux kernel's XFS filesystem could allow any unprivileged local user to silently gain root access on millions of enterprise systems, bypassing standard security measures including SELinux in Enforcing mode.

The Vulnerability

Qualys Threat Research Unit publicly disclosed CVE-2026-64600, dubbed "RefluXFS," on Tuesday, revealing a race condition in the XFS copy-on-write path that has existed since kernel version 4.11, released in 2017. The flaw allows an attacker to reflink-clone a protected file, then race two direct-I/O writes against the clone. When the kernel drops its inode lock while waiting for log space, a stale block address bypasses a reference-count check, causing one write to land directly on the original file's physical blocks.Daily CyberSecurity+1

The result is a silent overwrite of critical system files — such as /etc/passwd or SUID-root binaries — that persists across reboots and produces no kernel log output. In a proof-of-concept demonstration on a default RHEL 10.2 system, Qualys researchers stripped root's password protection in seconds, achieving passwordless root access.youtube+1

Scope and Impact

Qualys estimates the flaw potentially affects more than 16.4 million systems worldwide. Default installations of Red Hat Enterprise Linux, CentOS Stream, Oracle Linux ↘ 0.95%, Rocky Linux, AlmaLinux, Amazon Amazon.com, Inc. ↘ 1.09% Linux 2023, and Fedora Server are all vulnerable because XFS with reflink has been the default filesystem configuration since 2019. Debian, Ubuntu, and SUSE are at lower risk, exposed only if an administrator manually configured XFS with reflink enabled.Rankiteo Blog+2

The vulnerability operates at the filesystem allocation layer, beneath memory protections like KASLR, SMEP, and SMAP. Qualys noted that "SELinux doesn't block the affected path in testing," and container isolation also falls short.Daily CyberSecurity

Remediation

The fix merged into the mainline Linux kernel tree on July 16, 2026, and enterprise distributions are actively backporting the patch. Fixed kernels are already available for RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora. No in-the-wild exploitation has been confirmed, and Qualys has withheld public exploit code.Rankiteo Blog+1

There are no reliable temporary mitigations — patching and a full reboot remain the only effective response.youtube+1