RefluXFS LPE Hits Default RHEL, Fedora, Amazon Linux

Qualys disclosed CVE-2026-64600 on July 22 — a race condition in the Linux kernel’s XFS filesystem driver that has sat in the code for nine years. An unprivileged local user can exploit it to overwrite root-owned files and gain persistent root access. Default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux meet the conditions for exploitation without any unusual configuration. Qualys demonstrated the attack against live systems.

What the flaw is

Tracked as RefluXFS, the vulnerability is a race condition in the kernel’s XFS path. An attacker who wins the race gains the ability to overwrite files owned by root; from there, the path to persistent root access is reachable. Qualys demonstrated this against default systems.

This is a local privilege escalation, not a remote vulnerability. An attacker needs a foothold first — through a phishing payload dropped on a desktop, a misconfigured service running as a restricted user, or plain access on a multi-user system. The scope is bounded by that precondition. The impact once that bar is cleared: full root.

Who’s exposed

Qualys identified the following as vulnerable in default configuration:

• Red Hat Enterprise Linux and downstream — CentOS Stream, AlmaLinux, Rocky Linux
• Fedora Server
• Amazon Linux

The detail that matters: RHEL and most of its derivatives default to XFS as the root filesystem. No custom configuration is required to meet the exploitation conditions. Systems defaulting to ext4 — Ubuntu, Debian, and most non-RHEL enterprise Linux — are outside the scope of Qualys’s analysis.

What to do

Qualys practices coordinated disclosure; vendor patches should be available through standard update channels:

1. RHEL and derivatives: sudo dnf update kernel followed by a reboot. Check your vendor’s errata for the specific patched kernel version.
2. Fedora Server: sudo dnf update kernel and reboot.
3. Amazon Linux: sudo yum update kernel and reboot. Check the Amazon Linux Security Center for the specific advisory.
4. If a maintenance window is required before patching, audit who holds shell accounts on affected systems — the exploit path starts with local code execution.

Priority call

Internet-facing or multi-tenant RHEL/Fedora/Amazon Linux hosts: patch this maintenance cycle, not next. Internal RHEL workstations and servers with restricted shell access: next available window. Ubuntu, Debian, SUSE in default ext4 configurations: not in Qualys’s stated scope — monitor for any updated vendor analysis.

Nine years in the XFS code, and Qualys has a working demonstration. If your distro offers a kernel update for CVE-2026-64600, apply it.

For comparison on recent Linux LPEs: snap-confine on Ubuntu Desktop (CVE-2026-8933, also high/7.8, disclosed yesterday) and the bad-epoll kernel LPE from earlier this month.