Bottom Line: A seven-year-old undetected race condition in XFS allows unprivileged processes to overwrite arbitrary files and gain root access, but can only be fixed through a kernel update.
A race condition in the XFS file system implementation of Linux kernel 4.11+ enables local users to gain root access. The vulnerability (CVE-2026-64600) affects systems with the reflink feature enabled and has existed since 2017.
The vulnerability affects Linux systems with kernel 4.11 or newer where the XFS reflink feature is enabled. This feature makes it possible to create file copies without actually duplicating the data. The reflink feature is used in enterprise Linux deployments such as Red Hat Enterprise Linux 8, 9 and 10, CentOS Stream, Oracle Linux, Rocky, AlmaLinux, Amazon Linux 2023, and Debian/Ubuntu installations with XFS as default or manual configuration. Qualys estimates that over 16.4 million systems are affected.
The race condition occurs during concurrent write operations on reflink files. Normally, XFS allocates a new storage block before data is modified to protect the original version. The vulnerability enables an attacker to bypass these protection mechanisms and modify data directly on disk—without leaving kernel log entries. Exploitation requires only read access to a target file and the ability to create a reflink copy in a writable directory. Qualys assigns a CVSS score of 7.8 (high).
Hardening measures such as Kernel Address Space Layout Randomization (KASLR), Supervisor Mode Access Prevention (SMAP), Kernel Lockdown, or SELinux provide no protection against this exploit. Seccomp profiles are also ineffective, as they typically allow write and ioctl operations. The exploit is highly reliable and produces no detectable traces in the kernel log.
A patch was integrated into the upstream Linux kernel on July 16, 2024 as commit “2f4acd0”. Linux distributors have begun integrating the fix into their supported kernel versions. Organizations should immediately deploy available kernel updates from their Linux vendors and reboot affected systems. An immediate kernel update and a complete system restart are the only reliable mitigations.
Source: www.csoonline.com · Published July 23, 2026
Lumi AI News — AI-assisted curation according to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.