RefluXFS (CVE-2026-64600): 9 Years of XFS LPE Risk on RHEL
So, Qualys dropped a bombshell today with CVE-2026-64600 (dubbed RefluXFS). It’s a local privilege escalation (LPE) vulnerability that has been lurking in the Linux kernel for nine years.
The mechanics of this are fascinating but terrifying. It exploits a race condition that allows an unprivileged local user to overwrite root-owned files on an XFS filesystem. Since Red Hat Enterprise Linux, Fedora Server, and Amazon Linux use XFS as the default filesystem, this affects a massive chunk of the enterprise server fleet right out of the box.
The persistence capability here is the real kicker—it's not just a transient root shell; it's about overwriting critical system binaries or configuration files to maintain access.
First step for everyone should be verifying your filesystems. You can quickly check if you're running XFS on critical mount points using:
df -Th | grep xfs
And, of course, verify your current kernel version against your vendor's advisory immediately.
The complexity lies in the race window, but if a vendor like Qualys is publishing it, you know the exploit reliability is high. Is anyone else having flashbacks to Dirty Cow, or is it just me?
How are you all handling this? Are you forcing emergency reboots for kernel patches, or are you trying to mitigate via strict user permissions until the next maintenance window?
Just finished verifying our estate. 95% of our RHEL boxes are on XFS. This is going to be a painful weekend of patching.
If you can't reboot immediately, strictly limit local access. Ensure sudo configurations are tight and review who has shell access. This isn't exploitable remotely, so reducing the attack surface is key.
If you need to see which files are currently XFS mounts specifically for risk assessment, this helped me:
findmnt -t xfs
Detection is going to be tricky. Since it's a race condition leading to file overwrites, standard process monitoring might miss the window. We're looking for suspicious chown or chmod events on binaries that shouldn't be touched by non-root users.
Also, watch for rapid creation/deletion of temp files in XFS contexts. It's a specific behavior of the race. If anyone has a solid Sigma rule for this yet, please share.
This is a massive win for post-exploitation on internal engagements. Combine this with a simple web shell or weak service account, and you have full domain compromise in minutes.
I'm curious about the exact timing of the race. Qualys mentioned they demonstrated it, but usually, these take multiple attempts to land successfully. If anyone tests the PoC, let me know the reliability rate on high-load systems versus idle ones.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access