Overview
- Qualys disclosed RefluXFS (CVE-2026-64600) on July 22–23, 2026 after an upstream kernel fix was merged on July 16 and vendors began shipping backported kernels.
- The bug is a stale-mapping race in XFS reflink copy-on-write that lets an unprivileged user clone a root file, race O_DIRECT writes to the clone, and have those writes land in the original file's disk blocks.
- Because the overwrite happens at the block layer the file's inode never changes so ownership, permissions, timestamps, and the setuid bit remain intact and the change survives reboot.
- Exploitation requires three conditions: a kernel version 4.11 or later without the fix, an XFS filesystem created with reflink=1, and the target and an attacker-writable path on the same XFS filesystem.
- There is no reliable runtime mitigation so administrators should prioritize patching exposed and multi-tenant hosts, reboot to run the fixed kernel, check exposure with xfs_info, and note that Qualys used an AI-assisted review in finding the flaw.