A nine-year-old vulnerability in the Linux kernel's XFS filesystem implementation exposes default installations of Red Hat Enterprise Linux, Fedora Server, and Amazon Linux to local privilege escalation attacks. Tracked as CVE-2026-64600 and dubbed RefluXFS, the flaw allows unprivileged local users to overwrite root-owned files and achieve persistent root access.

Security firm Qualys disclosed the vulnerability on July 22. The researchers demonstrated a race condition in XFS that an attacker with basic local access can exploit without elevated privileges. The attack overwrites critical system files owned by root, enabling the attacker to maintain administrative control even after system reboots.

The vulnerability affects default configurations across multiple Linux distributions. RHEL and its community variants, Fedora Server installations, and Amazon Linux instances all ship with vulnerable settings. The implications are severe for multi-user systems, containerized environments, and cloud instances where untrusted local users may gain shell access.

Attackers do not need network access to exploit this flaw. A compromised application, container escape, or valid user account provides sufficient foothold for exploitation. Once root access is obtained, attackers can disable security controls, install persistent backdoors, and operate with full system privileges.

The nine-year existence of this vulnerability before disclosure raises questions about detection gaps in XFS code review processes. The race condition likely existed through multiple kernel versions and distribution releases. Qualys' work suggests the issue affects long-standing default configurations rather than recently introduced behavior.

Organizations running affected systems should prioritize kernel updates addressing CVE-2026-64600. RHEL users should apply security patches when released. Administrators managing systems where untrusted local users have shell access face highest risk. Restricting local user access, containerizing workloads with limited privileges, and hardening user environments provide interim mitigation while patches deploy