RefluXFS: a nine-year-old bug that can silently root 16 million Linux systems
Qualys disclosed a Linux kernel vulnerability this week that has been sitting in the XFS filesystem code for nine years. CVE-2026-64600, which Qualys named RefluXFS, lets an unprivileged local attacker overwrite protected on-disk files and gain root privileges. No in-wild exploitation has been confirmed, but the impact surface is large: Qualys estimates approximately 16.4 million systems running RHEL, Oracle Linux, Amazon Linux, and Fedora Server are affected.
The vulnerability
The flaw lives in the XFS copy-on-write path, specifically in how the kernel handles concurrent O_DIRECT writes against a reflink-enabled XFS volume. A race condition in that path allows an attacker to corrupt on-disk data directly. The corruption is persistent across reboots and leaves no artifacts in the kernel log. Standard defenses that rely on file integrity checks at the kernel level, such as SELinux, container isolation, and most kernel hardening configurations, do not block this class of exploit.
The attack requires local code execution on the target system. It is a privilege escalation technique, not a remote code execution vector. An attacker who already has a foothold as a low-privilege user can use this to gain root, which then enables any further action.
Why a nine-year-old bug matters now
The XFS bug was introduced in 2017. The question of why it took this long to surface has a straightforward answer: race conditions in filesystem code are difficult to find, particularly ones that require specific volume configurations such as reflink support and concurrent direct writes. Qualys's threat research team found it through systematic code analysis, not through wild exploitation.
The disclosure timeline is clean: Qualys coordinated with the Linux kernel security team, the fix merged on July 16, and distributions are actively backporting. RHEL, Oracle Linux, Amazon Linux, and Fedora Server all have patches available or pending. The practical remediation window is already open.
The silent root takeover concern
The reason this vulnerability is getting attention beyond its CVSS score is the combination of three properties: the modification persists across reboots, it leaves no kernel log artifacts, and it bypasses SELinux. An attacker who successfully exploits RefluXFS can write changes to protected files that survive system restarts and are invisible to standard log-review workflows. On systems with shared or multi-tenant access, that combination is operationally significant.
What to do
Apply pending kernel updates on all RHEL, Oracle Linux, Amazon Linux, and Fedora Server systems. This is the only complete remediation. For systems where patching is delayed, restrict to trusted users only, since the exploit requires local code execution. Audit for unexpected root-owned files written recently in protected paths, though the absence of log artifacts means audit coverage is incomplete. Treat this as priority-level patching for multi-user Linux environments.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss Linux kernel vulnerability assessment or enterprise patching workflows for this class of flaw.