A nine-year-old race condition vulnerability named RefluXFS (CVE-2026-64600) in the Linux kernel's XFS filesystem allows local attackers to overwrite protected files and gain root privileges, affecting systems with reflink enabled on kernel versions 4.11 and later. The flaw bypasses standard security defenses and leaves persistent, undetectable on-disk changes, prompting urgent patching by vendors and users, with no current reliable mitigations besides immediate kernel updates and reboots.
New RefluXFS Linux Flaw Lets Attackers Gain Root Privileges
