Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access.

The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data.

According to Qualys Threat Research Unit (TRU), there was a way around the file write protections reflink depends on. The bypass has existed in kernel versions since 2017 before a patch was made available last week.

“Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer,” Saeed Abbasi, head of Qualys TRU, said in a blog post about the vulnerability, which he calls  RefluXFS. “Exploitation is highly reliable and leaves no kernel log output.”

Qualys estimated that the issue affects more than 16.4 million systems, primarily enterprise Linux deployments that use XFS with reflink enabled by default.

Race winner gets root in buggy file operation

The vulnerability, tracked as CVE-2026-64600, stemmed from the way XFS handles copy-on-write operations for reflinked files. Normally, when two files share the same storage block, as in the case of an original file and the reflinked clone, XFS allocates a new storage block before any data modification, so the original file remains unchanged.

However, a race condition occurs when two concurrent writes on the reflink file are initiated, confusing the filesystem into modifying the original file. “The change is made directly on disk, persists across reboots, and produces no kernel log output,” Qualys said in an advisory.

The issue is exploitable when Linux 4.11+, XFS with reflink enabled, and a shared filesystem layout are all present. It is assigned a high severity CVSS of 7.8 out of 10 as an exploit only needs read access to a target file before creating a reflink clone under a writable directory on the same XFS filesystem.

Linux distributions affected by RefluXFS

The vulnerability has been present in every mainline and stable Linux kernel since the release of version 4.11 in 2017, and requires no special capabilities or non-default configurations, Qualys said.

Affected Linux distributions include RHEL 8,9 and 10, CentOS Stream 8,9, and 10, Oracle Linux 8,9,10, Rocky and AlmaLinux 8,9, and 10, CloudLinux 8,9, and 10, Amazon Linux 2023 and Amazon Linux 2 AMIs from December 2022 onward, Fedora Server 31+, and Debian, Ubuntu and SUSE installations where XFS was manually selected.

Usual kernel hardening practices, including memory protection features like Kernel Address Space Layout Randomization (KASLR), Supervisor Mode Access Prevention (SMAP), and Supervisor Mode Execution Prevention (SMEP), are ineffective as they are all aimed at different attack surfaces. Even a kernel lockdown does nothing to stop the affected path, Qualys noted.

“SELinux doesn’t block the affected path in testing, and seccomp profiles are no barrier as long as they permit write and ioctl, which ordinary profiles do,” Abbasi explained. Immediate kernel patching and a full reboot are the only reliable mitigations, he added.

A fix was merged into the upstream Linux kernel source tree on July 16 as commit “2f4acd0,” after which Linux distributions began backporting the patch into their own supported kernel releases.

Organizations running affected XFS deployments should apply their Linux vendor’s latest kernel updates and reboot affected systems once fixed kernels become available.

Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access.

The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data.

According to Qualys Threat Research Unit (TRU), there was a way around the file write protections reflink depends on. The bypass has existed in kernel versions since 2017 before a patch was made available last week.

“Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer,” Saeed Abbasi, head of Qualys TRU, said in a blog post about the vulnerability, which he calls  RefluXFS. “Exploitation is highly reliable and leaves no kernel log output.”

Qualys estimated that the issue affects more than 16.4 million systems, primarily enterprise Linux deployments that use XFS with reflink enabled by default.

Race winner gets root in buggy file operation

The vulnerability, tracked as CVE-2026-64600, stemmed from the way XFS handles copy-on-write operations for reflinked files. Normally, when two files share the same storage block, as in the case of an original file and the reflinked clone, XFS allocates a new storage block before any data modification, so the original file remains unchanged.

However, a race condition occurs when two concurrent writes on the reflink file are initiated, confusing the filesystem into modifying the original file. “The change is made directly on disk, persists across reboots, and produces no kernel log output,” Qualys said in an advisory.

The issue is exploitable when Linux 4.11+, XFS with reflink enabled, and a shared filesystem layout are all present. It is assigned a high severity CVSS of 7.8 out of 10 as an exploit only needs read access to a target file before creating a reflink clone under a writable directory on the same XFS filesystem.

Linux distributions affected by RefluXFS

The vulnerability has been present in every mainline and stable Linux kernel since the release of version 4.11 in 2017, and requires no special capabilities or non-default configurations, Qualys said.

Affected Linux distributions include RHEL 8,9 and 10, CentOS Stream 8,9, and 10, Oracle Linux 8,9,10, Rocky and AlmaLinux 8,9, and 10, CloudLinux 8,9, and 10, Amazon Linux 2023 and Amazon Linux 2 AMIs from December 2022 onward, Fedora Server 31+, and Debian, Ubuntu and SUSE installations where XFS was manually selected.

Usual kernel hardening practices, including memory protection features like Kernel Address Space Layout Randomization (KASLR), Supervisor Mode Access Prevention (SMAP), and Supervisor Mode Execution Prevention (SMEP), are ineffective as they are all aimed at different attack surfaces. Even a kernel lockdown does nothing to stop the affected path, Qualys noted.

“SELinux doesn’t block the affected path in testing, and seccomp profiles are no barrier as long as they permit write and ioctl, which ordinary profiles do,” Abbasi explained. Immediate kernel patching and a full reboot are the only reliable mitigations, he added.

A fix was merged into the upstream Linux kernel source tree on July 16 as commit “2f4acd0,” after which Linux distributions began backporting the patch into their own supported kernel releases.

Organizations running affected XFS deployments should apply their Linux vendor’s latest kernel updates and reboot affected systems once fixed kernels become available.

This article first appeared on Network World.