RefluXFS: a Local Privilege Escalation to root in XFS, Found with AI

The Qualys Threat Research Unit has reported a vulnerability, CVE-2026-64600, dubbed RefluXFS. It is a race condition in the copy-on-write (CoW) path of the XFS file system in the Linux kernel. An ordinary local user with no privileges whatsoever can exploit it to overwrite the contents of any readable file on an XFS volume with reflink enabled — and thereby gain root on the host.

How it works

The fault arises when two O_DIRECT writes hit the same reflink file at once. To avoid a deadlock, the kernel temporarily releases the inode lock while waiting for space in the transaction journal. In this window the second writer manages to complete its own CoW cycle and drop the reference count on the source block to one. When the first writer reacquires the lock, it rechecks the count against a stale physical block address captured before the lock was released. Seeing a count of one, it mistakenly treats the block as private and writes straight into the source file. Because O_DIRECT bypasses the page cache and performs no recheck, the write reaches the disk.

The result: the change survives a reboot, leaves no entries in the kernel log, and bypasses standard metadata checks. In a demonstration on a fresh RHEL 10.2 installation, the exploit strips the password from the root account in a matter of seconds.

Why defenses don't help

The vulnerability lives at the file system's block-allocation layer — below most of the usual protection mechanisms. KASLR, SMEP, and SMAP target memory and are useless here. Kernel lockdown does not restrict O_DIRECT or FICLONE for ordinary users. SELinux in Enforcing mode does not block the path, seccomp lets write and ioctl through, and container isolation and user namespaces operate at layers the fault simply never touches. According to Qualys, there is no reliable workaround — only a kernel update and a full reboot will help.

Every kernel from version 4.11 (2017) onward is affected if unpatched and using XFS with reflink=1. This is the default configuration in RHEL, Oracle Linux, Amazon Linux, Fedora Server, and RHEL derivatives. Debian, Ubuntu, and SUSE are vulnerable only if the administrator manually chose XFS. By Qualys's estimate, more than 16.4 million systems are at risk. Fixed kernels have already been released and are being ported into enterprise distributions.

The role of artificial intelligence

What is remarkable is how the vulnerability was discovered. Qualys built Anthropic's Claude Mythos Preview model into a manual audit, tasking it with hunting for a race condition in the spirit of Dirty COW. After several iterations of refining the prompts, the model found the race in XFS and generated a working PoC. From there the researchers reproduced the exploit themselves and verified every claim. The authors' conclusion is measured: the point is not that AI can write exploits, but that, paired with expert judgment, it helps defenders find serious bugs before attackers do.

Source: Lobsters