RefluXFS: Linux Kernel XFS Race Condition Allows Local Root
Nine-year-old XFS race condition in the Linux kernel lets an unprivileged local user gain persistent root access on default RHEL, Fedora Server, and Amazon Linux installs.
- Vendor
- Linux Kernel
- Product
- Linux kernel (XFS filesystem driver)
- CVSS
- 7.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-64600 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-64600 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-64600 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Qualys disclosed CVE-2026-64600 on July 22, 2026 — a nine-year-old race condition in the Linux kernel’s XFS filesystem driver, tracked as RefluXFS. An unprivileged local user can trigger the race to overwrite root-owned files and gain persistent root access. Qualys demonstrated exploitation against default installations of Red Hat Enterprise Linux (and derivatives including CentOS Stream, AlmaLinux, and Rocky Linux), Fedora Server, and Amazon Linux.
This is a local privilege escalation (LPE). An attacker needs shell access to the affected system before exploitation is possible.
Affected platforms: RHEL and derivatives, Fedora Server, Amazon Linux — systems defaulting to XFS as the root filesystem. Ext4-default distros (Ubuntu, Debian) are outside the stated scope.
Remediation: Apply vendor kernel updates. For RHEL and Fedora: sudo dnf update kernel and reboot. For Amazon Linux: sudo yum update kernel and reboot.
Other Linux Kernel CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-72157 Linux kernel ThunderboltIP frags[] array overflow in tbnet_poll()write-up | [ HIGH ] | — | 0.4% | — |
| CVE-2026-72135 Linux kernel TPM character device pread() out-of-bounds readwrite-up | [ MEDIUM ] | — | 0.2% | — |
| CVE-2026-72130 Linux kernel NVMe-oF auth heap overflow via short AUTH_RECEIVE bufferwrite-up | [ HIGH ] | — | 0.8% | — |
| CVE-2026-72103 Linux dm keyring leak causes silent LUKS volume key wipe failurewrite-up | [ MEDIUM ] | — | 0.2% | — |
| CVE-2026-72044 ksmbd multichannel session-key stack buffer overflowwrite-up | [ HIGH ] | — | 0.2% | — |
