RefluXFS: XFS reflink race lets Linux users escalate to root (CVE-2026-64600)
Qualys details RefluXFS (CVE-2026-64600), an XFS reflink race enabling local privilege escalation to root on default RHEL, Rocky, and Fedora Server installs.
Qualys disclosed RefluXFS, a race condition in the Linux kernel's XFS filesystem that lets an unprivileged local user overwrite the on-disk contents of any file they can read - including root-owned config files and SUID binaries - on any XFS volume created with reflink support, which has been the mkfs.xfs default since 2019.
The attack works by reflink-cloning a target file (such as /etc/passwd or /usr/bin/su) into a scratch file the attacker owns, then racing concurrent O_DIRECT writes against that copy. A lock-drop window in the kernel's copy-on-write allocation path lets one of those writes land on the physical block still backing the original file instead of the attacker's own storage. The corruption is written directly to disk, survives reboot, leaves no kernel log trace, and never touches the target's inode - so a modified SUID-root binary keeps its SUID bit.
The bug traces back to a 2017 commit in Linux 4.11 and was patched on July 16, 2026. Because reflink has been XFS's default since 2019, out-of-the-box installs of RHEL, CentOS, Rocky Linux, AlmaLinux (8-10), Oracle Linux, Fedora Server, and Amazon Linux are exploitable, since world-writable directories like /var/tmp typically share the same XFS volume as /etc and /usr/bin.