RefluXFS: Linux Kernel XFS Race Condition Allows Local Root
Nine-year-old XFS race condition in the Linux kernel lets an unprivileged local user gain persistent root access on default RHEL, Fedora Server, and Amazon Linux installs.
- Vendor
- Linux Kernel
- Product
- Linux kernel (XFS filesystem driver)
- CVSS
- 7.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Qualys disclosed CVE-2026-64600 on July 22, 2026 — a nine-year-old race condition in the Linux kernel’s XFS filesystem driver, tracked as RefluXFS. An unprivileged local user can trigger the race to overwrite root-owned files and gain persistent root access. Qualys demonstrated exploitation against default installations of Red Hat Enterprise Linux (and derivatives including CentOS Stream, AlmaLinux, and Rocky Linux), Fedora Server, and Amazon Linux.
This is a local privilege escalation (LPE). An attacker needs shell access to the affected system before exploitation is possible.
Affected platforms: RHEL and derivatives, Fedora Server, Amazon Linux — systems defaulting to XFS as the root filesystem. Ext4-default distros (Ubuntu, Debian) are outside the stated scope.
Remediation: Apply vendor kernel updates. For RHEL and Fedora: sudo dnf update kernel and reboot. For Amazon Linux: sudo yum update kernel and reboot.
