Vulnerabilities & Exploits

XFS bug lets local users rewrite root files

An ordinary local account can turn into root on affected XFS hosts even when SELinux is Enforcing. The break is in the filesystem layer, so host hardening does not contain it once a local user can touch the race.

Qualys published a proof of concept for CVE-2026-64600 and says the exploit is reliable, leaves no kernel log output, and works on XFS root filesystems with reflink enabled. It affects Linux systems including default installs of RHEL, Oracle Linux, Amazon Linux, and Fedora, and the on-disk change survives reboot.

That means a local compromise is no longer scoped to one user account. On exposed or multi-tenant Linux servers, the attacker can overwrite protected files and keep the result across restarts.

3 sources · Jul 23

Timeline

• Jul 23 Reported by BleepingComputer
• Jul 22 Reported by Qualys

Sources

• Jul 23 The Hacker News

  Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

  CVE-2026-64600 lets local users overwrite root-owned files on reflink-enabled XFS systems, preserving metadata and persistent root access after reboot

  original

• Jul 23 BleepingComputer

  New RefluXFS Linux flaw lets attackers gain root privileges

  A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.

  original

• Jul 22 Qualys

  RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) | Qualys

  Qualys Threat Research Unit (TRU) identified CVE-2026-64600, a race condition in the Linux kernel’s XFS filesystem copy-on-write path.

  original

Part of the PlainSec briefing for 2026-07-22

Every edition of this story: XFS bug lets local users rewrite root files

More from today

• GitHub Actions turned into cPanel attack infrastructure
• Langflow intrusion now targets the model itself
• GlobalProtect auth bypass now opens the inside