Linux kernel flaw lets local users gain root access

Qualys has disclosed a Linux kernel vulnerability called RefluXFS that could allow a local user to gain root privileges on affected systems. The flaw may affect more than 16.4 million systems worldwide.

Tracked as CVE-2026-64600, the vulnerability lies in the XFS filesystem copy-on-write path and has been present since Linux kernel 4.11. It affects XFS-based environments across distributions including Red Hat Enterprise Linux, Oracle Linux, Amazon Linux and Fedora. Debian, Ubuntu and SUSE can also be exposed if administrators choose XFS with reflink enabled.

Qualys said the flaw lets an ordinary local account overwrite protected files on disk and then obtain root privileges on the host. The issue can be exploited even on systems running SELinux in enforcing mode, leaves no kernel log output and survives a reboot.

How it works

The problem is a race condition triggered by two concurrent direct writes targeting the same reflinked file on XFS. Qualys said this can let an unprivileged user overwrite the on-disk contents of any readable file on a reflink-enabled XFS volume at the block layer.

Its proof of concept used that route to alter files such as /etc/passwd or SUID-root binaries. On a default deployment of Red Hat Enterprise Linux 10.2, the exploit removed the root account's password protection within seconds and delivered passwordless root access.

That makes the flaw especially serious for shared servers, multi-tenant systems and other environments where attackers may already have a foothold through a low-privilege account. Although the bug is local rather than remote, a successful exploit could help an intruder establish persistence, tamper with credentials or move deeper into a network.

AI-assisted research

Qualys also linked the discovery to a research project involving Anthropic's Claude Mythos Preview. Its researchers said they directed the model through a structured manual audit designed to find a Dirty COW-style race condition in the Linux kernel, then independently reproduced the exploit and verified the technical findings.

Qualys described the workflow as a combination of machine-assisted searching and human-led validation. According to the company, the model identified the XFS race condition and produced an initial proof of concept, while researchers reviewed the reasoning, reproduced the result and handled disclosure with maintainers.

Saeed Abbasi, Head of Threat Research Unit, Director of Product, Qualys, described the approach in measured terms. "RefluXFS is less about what AI can do than how it's used responsibly. Capable models have been broadly available for some time; direction, not capability, was the constraint. The lesson isn't that AI can be aimed at software to produce exploits; it's that AI, paired with expert judgment, helps defenders find and close serious flaws before they're abused," Abbasi said.

Patch priority

Vendor-fixed kernels are available and are being backported into enterprise distributions, according to Qualys. The company urged organisations to patch affected systems immediately and reboot them, saying there are no reliable temporary mitigations or practical configuration changes that can contain the risk.

Qualys argued that common hardening measures do not stop this form of attack because it operates at the filesystem allocation layer rather than through the memory corruption routes addressed by protections such as KASLR, SMEP and SMAP. In its testing, kernel lockdown, typical seccomp profiles, container restrictions and SELinux also did not block the affected path.

The issue is present in standard enterprise kernel builds and requires no special privileges beyond a local user account, Qualys said. It added that organisations should prioritise exposed and multi-tenant systems, where the consequences of a low-privilege-to-root escalation are likely to be highest.

Qualys said its estimate of more than 16.4 million potentially affected systems was based on analysis of its CyberSecurity Asset Management data. It also released detection coverage for customers tracking vulnerable kernel versions and related distribution updates.

The XFS maintainers and the Linux kernel security team coordinated the fixes. Qualys specifically thanked Carlos Maiolino, Greg Kroah-Hartman, Darrick J. Wong, Linus Torvalds, David Woodhouse and Willy Tarreau for their work on patching.

"Immediate kernel patching and a full reboot are the only reliable mitigations," Abbasi said.