# RefluXFS: A Nine-Year-Old Linux Kernel Race Condition That Rewrites Files Behind Your Back
## The Threat
A race condition buried in the Linux kernel's XFS filesystem since February 2017 has spent nearly a decade waiting to be found. Dubbed RefluXFS by Qualys' Threat Research Unit, CVE-2026-64600 lets any unprivileged local user overwrite arbitrary root-owned files — including /etc/passwd and SUID-root binaries — without touching their inodes, leaving no kernel log output, and surviving a system reboot. The modification happens at the raw block layer. Your SUID bit stays intact. Your inode timestamps don't budge. From the filesystem's perspective, nothing happened.
The mechanism is precise: an attacker reflink-clones a target file (say, /usr/bin/su) into a scratch file they control. Then they race concurrent O_DIRECT writes against that scratch file. Inside the kernel's copy-on-write allocation path, a brief lock-drop window allows one of those writes to land not in the attacker's storage blocks, but in the physical block that still backs the original target file. The kernel has handed a local user a direct write channel to a root-owned file's on-disk data. The result is durable, silent, and — critically — highly reliable to reproduce.
What makes RefluXFS especially uncomfortable is what it bypasses. SELinux, kernel lockdown, KASLR, SMEP, SMAP, and container isolation mechanisms are all irrelevant. They operate above the filesystem allocation layer. This attack goes underneath them. Standard hardening playbooks offer nothing here.
## Severity and Impact
| Field | Detail |
|---|---|
| CVE | CVE-2026-64600 |
| CVSS Score | Not yet officially published |
| Attack Vector | Local |
| Attack Complexity | Low (highly reliable under standard configurations) |
| Privileges Required | Low (unprivileged local user) |
| User Interaction | None |
| Impact | Complete privilege escalation to root |
| CWE | CWE-362 — Concurrent Execution Using Shared Resource with Improper Synchronization (Race Condition) |
| Introduced | Linux kernel v4.11 (commit 3c68d44a2b49, February 2017) |
| Patched | July 16, 2026 (commit 2f4acd0 merged into mainline) |
| Persistence | On-disk modification survives reboot |
| Stealth | No kernel log output |
## Affected Products
Required conditions for exploitation:
Affected distributions (vendor patches now being backported):
Qualys estimates exposure across more than 16.4 million systems based on Cybersecurity Asset Management telemetry.
## Mitigations
Patch immediately. Qualys is explicit: there are no reliable interim mitigations or configuration changes that block RefluXFS. The flaw operates below the level where access controls, namespacing, or standard hardening apply.
1. Apply vendor kernel updates as soon as they are available for your distribution. RHEL, Amazon Linux, and the RHEL-adjacent distros (Rocky, Alma, CloudLinux, Oracle) are actively backporting the fix now.
2. Reboot after patching. The fix must be running in memory to take effect; the patch alone does not reverse any modifications already made by an exploit.
3. Audit SUID-root binaries and critical config files for unexpected modifications if you have multi-tenant or shared-access systems. Check inode change times against known-good baselines — the attacker doesn't modify the inode, but an integrity baseline (e.g., AIDE, Tripwire, or an IMA policy) based on file content hashes will catch a tampered binary.
4. Prioritize multi-tenant environments — cloud VMs, shared dev servers, CI/CD runners, and container hosts where unprivileged local access is routine. These are the highest-risk scenarios.
5. Monitor for exploitation indicators by watching for unexpected privilege escalations, modified SUID binaries, or anomalous /etc/passwd changes. Standard log monitoring won't catch the write itself, but post-exploitation behavior may still surface.
## References
---
## HackWire Analysis
RefluXFS is being talked about mostly as a patching priority — and it is — but the more interesting story is how it was found. Qualys integrated Claude Mythos Preview into their manual audit workflow with a specific directive: hunt for race conditions resembling Dirty COW. The model identified the XFS flaw and produced a functional proof-of-concept. Qualys researchers then reproduced it independently and coordinated disclosure.
That's not AI replacing security research. That's AI dramatically compressing the search space for a class of bugs that has historically taken years of expert eyes to surface — if they're found at all. Dirty COW (CVE-2016-5195) went nine years before discovery. RefluXFS went the same distance before an AI-assisted audit caught it. The implication is uncomfortable: how many more are in that 4.11-era codebase?
This also belongs to a pattern that's accelerating. Qualys has named eight Linux local privilege escalation vulnerabilities disclosed since the start of 2026 alone: CIFSwitch, PinTheft, Copy Fail, Dirty Frag, Fragnesia, Pack2TheRoot, DirtyDecrypt, DirtyCBC, and now RefluXFS. The pace suggests two things simultaneously — researchers are getting better at finding these bugs, and the Linux kernel's attack surface in edge-case filesystem paths remains deep.
For defenders, the practical reality is stark: 16.4 million systems, no workaround, no mitigating configuration, no bypass in your security stack. If you run XFS with reflink (and on RHEL derivatives, you do by default), the blast radius is your entire local-access footprint. Cloud VMs with shared tenancy, shared CI runners, developer workstations with multiple users — patch those first, reboot, then verify with a content hash baseline. This one doesn't leave you a safety net to fall back on.
— HackWire Editorial
---
## Related Coverage