RefluXFS: 9-Year-Old Linux Kernel Vulnerability Exposes Millions of Devices
Security firm Qualys has disclosed RefluXFS (CVE-2026-64600), a high-severity local privilege escalation vulnerability in the Linux kernel's XFS filesystem CoW mechanism. Discovered using AI-assisted analysis with Claude, the flaw has existed since Linux kernel version 4.11 in 2017. The vulnerability affects over 16.4 million Linux hosts running enterprise distributions like RHEL, Oracle Linux, and Amazon Linux with XFS reflink enabled. Because it stems from a filesystem design flaw, it bypasses major kernel mitigations like SMEP, SMAP, and KASLR, making it highly dangerous. The vulnerability is caused by a race condition in the XFS copy-on-write (CoW) and direct-I/O handling, allowing attackers to overwrite critical system files. Although upstream patches have been merged, users must wait for their respective Linux distributions to release updated kernels.
## BACKGROUND
XFS is a high-performance journaling filesystem commonly used in enterprise Linux distributions. The "reflink" feature allows file cloning via copy-on-write (CoW), meaning data blocks are shared until one file is modified. SMEP (Supervisor Mode Execution Prevention) and SMAP (Supervisor Mode Access Prevention) are hardware-enforced CPU security features designed to prevent the kernel from executing or accessing user-space memory.