Qualys disclosed RefluXFS, a race condition in the Linux kernel's XFS copy-on-write path that lets an ordinary local user overwrite protected files and take root. Tracked as CVE-2026-64600, it triggers when two concurrent direct writes target the same reflinked file: the kernel briefly drops its inode lock, and a second writer can make the first write land on a stale block. The overwrite happens at the block layer, so ownership, permissions, timestamps, and the setuid bit stay untouched and no kernel log entry appears. Qualys reports it works with SELinux enforcing and estimates over 16 million affected systems.
Qualys disclosed a privilege escalation flaw in snap-confine, the component that builds the sandbox for every snap application. CVE-2026-8933, rated 7.8, affects default installations of Ubuntu Desktop 24.04, 25.10, and 26.04, and stems from a 2025 hardening change that moved snap-confine from a setuid root binary to a capabilities model, introducing a race during sandbox setup. An attacker mounts a filesystem over the temporary scratch directory, plants a symlink so a privileged write lands on another file, then drops a udev rule that makes a system service run commands as root. Fixes shipped July 21.
Microsoft has patched RoguePlanet, a Microsoft Defender flaw that a public proof-of-concept had been exploiting since June to gain SYSTEM privileges on fully updated Windows machines. Tracked as CVE-2026-50656, the bug is a race condition in Defender's scanning engine: a low-privileged attacker who already has code running on a host can win a timing window to spawn a command shell as SYSTEM, and the public exploit worked whether or not real-time protection was enabled. It does not provide initial access, but it turns any foothold into full local control, useful for disabling defenses, stealing credentials, and moving laterally. It is the fourth Defender flaw disclosed by the same researcher this year.
TrustStrike Labs