RefluxFS: Nine-Year-Old Linux Kernel Bug Grants Root Privileges

A long-dormant flaw in one of the most widely used Linux filesystems has been uncovered, posing a significant local privilege escalation risk. The RefluxFS Linux vulnerability, tracked as CVE-2026-64600, is a nine-year-old race condition residing within the kernel’s XFS filesystem driver. If successfully exploited, a local attacker with low-privilege access can bypass security controls, overwrite protected files, and escalate their privileges to root.

Because XFS is the default filesystem for several major enterprise Linux distributions—including Red Hat Enterprise Linux (RHEL), CentOS, and Rocky Linux—the reach of this vulnerability across server environments is extensive.

Anatomy of the Race Condition

The core of the RefluxFS vulnerability lies in how the Linux kernel’s XFS driver handles concurrent file operations. A race condition occurs when two or more operations attempt to modify the same resource simultaneously without proper synchronization.

In the case of CVE-2026-64600, a local attacker can exploit a timing window during file system transactions. By carefully timing input/output operations, the attacker can force the kernel into a state where it performs operations on file metadata using elevated privileges, but points to a file path controlled by the unprivileged user. This allows the attacker to manipulate file locks or blocks, ultimately granting them unauthorized write access to critical system files, such as /etc/passwd or /etc/shadow, which can then be modified to grant permanent root access.

The Risk of Local Privilege Escalation

While local privilege escalation (LPE) vulnerabilities require initial access to a system to be exploited, they are a vital link in the modern cyberattack chain. Threat actors frequently gain initial access via phishing, compromised ssh keys, or web application vulnerabilities (such as SQL injection or remote code execution in a web server).

Once inside a system as a low-privilege user (such as www-data or a standard domain user), the attacker’s next step is almost always to find an LPE exploit to gain root control. A reliable kernel-level privilege escalation tool like RefluxFS allows attackers to disable security auditing, install persistent rootkits, access sensitive configuration files, and move laterally across containerized environments sharing the host kernel.

Remediation and Defenses

To defend against RefluxFS, system administrators should implement the following targeted controls:

• Update the Linux Kernel: Apply the latest kernel updates provided by your distribution vendor. Upstream Linux kernel patches have resolved the race condition in the XFS subsystem.
• Determine Filesystem Usage: Check whether your systems are actively utilizing XFS by running the command df -h -T or mount | grep xfs. If XFS is not required on a system, ensure the module is not loaded, though patching remains the primary security control.
• Restrict Local Access: Minimize the number of users with shell access to sensitive servers and container hosts, as this exploit requires the ability to execute local code.