Nine year old Linux kernel flaw gives local users root on default RHEL installs

Qualys disclosed RefluXFS, a race condition in the Linux kernel's XFS copy-on-write path that lets an ordinary local user overwrite protected files and take root. Tracked as CVE-2026-64600, it triggers when two concurrent direct writes target the same reflinked file: the kernel briefly drops its inode lock, and a second writer can make the first write land on a stale block. The overwrite happens at the block layer, so ownership, permissions, timestamps, and the setuid bit stay untouched and no kernel log entry appears. Qualys reports it works with SELinux enforcing and estimates over 16 million affected systems.

Check

Update kernels on hosts using XFS with reflink enabled, then reboot to apply, and prioritize shared systems where untrusted users or workloads already have local execution.

Affected

Systems running Linux 4.11 or later with a reflink enabled XFS filesystem (CVE-2026-64600), which is the default on Red Hat Enterprise Linux and derivatives, Oracle Linux, Amazon Linux, and Fedora Server.

Fix

Install vendor backported kernels and reboot, since the fix merged upstream on July 16. Debian, Ubuntu, and SUSE are exposed only where an administrator chose XFS with reflink at install.