Researchers at Qualys’s Threat Research Unit have disclosed a Linux kernel vulnerability that turns an ordinary local user account into full root access — without tripping a single kernel log entry. The flaw, nicknamed “RefluXFS” and formally tracked as CVE-2026-64600, lives in the XFS filesystem’s copy-on-write handling and has reportedly gone unnoticed in every mainline and stable kernel release since version 4.11, shipped back in 2017.

A Timing Gap in a Trusted Filesystem Feature

XFS is one of the most widely deployed filesystems in enterprise Linux environments, and its reflink feature — which allows multiple files to efficiently share underlying storage blocks until one of them is modified — is common in production deployments. RefluXFS exploits a narrow timing window in exactly that mechanism.

Normally, when a process writes to a block shared between reflinked files, the kernel allocates a new private block and remaps the file to point at it. The problem arises because the kernel briefly releases its inode lock while it waits for space in the filesystem’s transaction log. During that brief window, a second concurrent write using the O_DIRECT flag can slip in, remap the file, and drop the original reference count. The first writer, still holding a now-stale reference, ends up writing directly to the original shared block instead of a fresh, private one. Because O_DIRECT writes bypass the page cache and skip the usual revalidation checks, the corrupted write lands permanently on disk.

From Race Condition to Root, Fast

In practice, an unprivileged local user can exploit this race to overwrite any file they can read on a reflink-enabled XFS volume, effectively rewriting data at the block-storage layer rather than through normal file permission checks. Qualys says its proof-of-concept demonstrated the attack against a default Red Hat Enterprise Linux 10.2 installation, silently stripping the root account’s password protection within seconds and handing over immediate, passwordless root access.

Two details make this particularly dangerous for defenders: the modification survives a system reboot, and it leaves no artifacts in kernel logs, making after-the-fact detection extremely difficult without specialized file-integrity monitoring already in place.

Scope and Vulnerable Conditions

Qualys estimates that more than 16.4 million systems worldwide could be affected, based on analysis using its CyberSecurity Asset Management platform. Exploitation requires three conditions to line up: a kernel version 4.11 or newer that hasn’t received the fix, an XFS filesystem with the reflink feature enabled, and a directory writable by an unprivileged user that also gives access to a high-value target such as a SUID-root binary.

Enterprise Linux distributions carry the highest exposure, since many enable reflink support by default on XFS. Confirmed affected distributions include RHEL, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, and CloudLinux across versions 8, 9, and 10, along with Amazon Linux 2023 and Amazon Linux 2 (December 2022 and later), plus Fedora Server 31 and above. Debian, Ubuntu, and SUSE carry comparatively lower risk, since reflink-enabled XFS isn’t their default configuration and typically has to be manually selected.

Existing Defenses Don’t Help

What makes RefluXFS especially concerning is that it operates below the layer most conventional kernel hardening was designed to protect. Memory-protection features like KASLR, SMEP, and SMAP target entirely different classes of attacks; kernel lockdown mode places no restriction on the O_DIRECT or FICLONE system calls involved; and testing found that SELinux does not block the vulnerable code path even in Enforcing mode. Container isolation techniques, including user-namespace restrictions and capability limits, also fail to reach this layer. In short, there is currently no reliable interim workaround — patching is the only real fix.

An AI-Assisted Discovery

Notably, the vulnerability was surfaced through a joint research effort between Qualys and Anthropic, which integrated an AI model into the Threat Research Unit’s manual audit workflow. Researchers tasked the model with hunting for race conditions in the style of the historic “Dirty COW” vulnerability; after iterative prompting, it identified the XFS flaw and produced a working proof-of-concept, which Qualys engineers then independently verified before coordinating disclosure with upstream kernel maintainers.

RefluXFS is the fourth vulnerability in a related family of Linux kernel bugs disclosed within roughly three months, following Copy Fail, Dirty Frag, and DirtyClone — all of which involve tricking the kernel into writing attacker-controlled data into disk or memory regions that back sensitive files.

What to Do Now

Vendor-patched kernels are already available and being backported across major enterprise distributions, including RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora. Qualys is urging organizations to prioritize patching internet-facing and multi-tenant systems immediately, apply the relevant distribution security update, and perform a full reboot to confirm the fix has taken effect — since, absent a reboot and patch, no configuration change currently neutralizes the flaw.