RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)

RefluXFS：Linux 内核 XFS 文件系统中的本地提权漏洞 (CVE-2026-64600)

Executive summary

执行摘要

Qualys Threat Research Unit (TRU) identified CVE-2026-64600, a race condition in the Linux kernel’s XFS filesystem copy-on-write path. An attacker with an ordinary local account can exploit this race condition to overwrite protected files on disk and gain host root privileges on affected systems, including deployments running SELinux in Enforcing mode. Qualys 威胁研究小组 (TRU) 发现了 CVE-2026-64600，这是一个存在于 Linux 内核 XFS 文件系统“写时复制”(copy-on-write) 路径中的竞争条件漏洞。拥有普通本地账户的攻击者可以利用此竞争条件覆盖磁盘上的受保护文件，并在受影响的系统（包括运行在强制模式下的 SELinux 系统）上获取主机 root 权限。

This discovery emerged from a structured research initiative between Qualys and Anthropic, where we integrated Claude Mythos Preview into our manual audit workflow to accelerate our research while maintaining strict human oversight. Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer. This primitive converts directly into host root privileges. Exploitation is highly reliable and leaves no kernel log output. 这一发现源于 Qualys 与 Anthropic 之间的一项结构化研究计划，我们将 Claude Mythos Preview 集成到人工审计工作流程中，在保持严格人工监督的同时加速了研究进程。利用该漏洞，以普通非特权用户身份运行的进程可以触发缺陷，并获得在块层覆盖 XFS 卷上任何可读文件的能力。这种基础操作可直接转化为主机 root 权限。该漏洞利用非常稳定，且不会留下任何内核日志输出。

The vulnerability affects any Linux distribution that ships an XFS root filesystem with reflink enabled. This includes default installations of major enterprise platforms such as RHEL, Oracle Linux, Amazon Linux, and Fedora. This vulnerability has been present since kernel version 4.11 (circa 2017) and, based on analysis with Qualys CyberSecurity Asset Management, potentially impacts over 16.4 million systems worldwide, requiring immediate attention due to its high exploitability and lack of kernel logging. 该漏洞影响所有默认启用 reflink 的 XFS 根文件系统的 Linux 发行版。这包括 RHEL、Oracle Linux、Amazon Linux 和 Fedora 等主要企业平台的默认安装。该漏洞自内核版本 4.11（约 2017 年）以来一直存在。根据 Qualys 网络安全资产管理系统的分析，全球潜在受影响系统超过 1640 万台。由于其极高的可利用性且缺乏内核日志记录，该漏洞需要立即引起重视。

Immediate kernel patching is recommended to neutralize this vulnerability. Exploitation succeeds consistently under standard hardening settings, and the on-disk modification survives a system reboot. Vendor-fixed kernels are now available and being backported to enterprise distributions. Organizations should prioritize patching exposed and multi-tenant systems and ensure a reboot to verify the update. As of now, there are no reliable or practical mitigations or temporary configuration changes available. 建议立即修补内核以消除此漏洞。在标准加固设置下，该漏洞利用均能成功，且磁盘上的修改在系统重启后依然有效。供应商提供的修复内核现已发布，并正在向企业发行版进行反向移植。各组织应优先修补暴露在外的多租户系统，并确保重启以验证更新。目前，尚无可靠或实用的缓解措施或临时配置更改方案。

We rate this as an emergency priority because exploitation could begin from ordinary local privileges. The vulnerability is present in standard enterprise kernel builds, and a successful exploitation provides host root. The exploitation works under common kernel hardening settings, and fixed kernels are available. 我们将此漏洞评定为紧急优先级，因为攻击可以从普通本地权限开始。该漏洞存在于标准企业内核构建中，成功利用即可获得主机 root 权限。该漏洞在常见的内核加固设置下均可利用，且修复后的内核已经可用。

RefluXFS is less about what AI can do than how it’s used responsibly. Capable models have been broadly available for some time; direction, not capability, was the constraint. The lesson isn’t that AI can be aimed at software to produce exploits; it’s that AI, paired with expert judgment, helps defenders find and close serious flaws before they’re abused. RefluXFS 的意义不在于 AI 能做什么，而在于如何负责任地使用它。功能强大的模型早已广泛可用；限制因素在于方向而非能力。其教训不在于 AI 可以被用来针对软件制造漏洞，而在于 AI 结合专家判断，能够帮助防御者在严重缺陷被滥用之前发现并修复它们。

Discovery process and research methodology

发现过程与研究方法

For this research, we tasked Claude Mythos Preview with hunting for a Dirty COW–style race condition in the Linux kernel, iteratively refining our prompts to narrow its focus toward race conditions in the core memory-management and filesystem directories. After several iterations, the model identified a race condition in the XFS filesystem and generated a functional proof-of-concept local privilege escalation. 在本次研究中，我们要求 Claude Mythos Preview 在 Linux 内核中寻找类似 Dirty COW 的竞争条件，并通过迭代优化提示词，将其重点缩小到核心内存管理和文件系统目录中的竞争条件。经过多次迭代，该模型识别出了 XFS 文件系统中的一个竞争条件，并生成了一个功能性的本地提权概念验证 (PoC)。

Our security researchers then took over: we reviewed the model’s reasoning, reproduced the exploit, and independently verified every technical claim before coordinating disclosure with upstream维护者. The model also produced an initial draft of the advisory, which our team validated and corrected against our own testing. This human-validated, AI-accelerated approach let us surface a complex kernel race condition while holding to the strict accuracy and responsible-disclosure standards expected; every finding here cleared the same evidence bar we apply to any Qualys security advisory. 随后，我们的安全研究人员接手工作：我们审查了模型的推理过程，复现了漏洞利用，并在与上游维护者协调披露之前，独立验证了每一项技术主张。该模型还生成了公告的初稿，我们的团队根据自己的测试对其进行了验证和修正。这种经人工验证、由 AI 加速的方法使我们能够在保持严格的准确性和负责任的披露标准的同时，发现复杂的内核竞争条件；这里的每一项发现都达到了我们对任何 Qualys 安全公告所要求的相同证据标准。

Understanding the Potential Impact of the RefluXFS Vulnerability

理解 RefluXFS 漏洞的潜在影响

An unprivileged local user can overwrite the on-disk contents of any readable file on a reflink-enabled XFS volume. Our proof-of-concept reliably gains host root privileges by surgically modifying /etc/passwd or SUID-root binaries. Changes persist across reboots, leave no kernel log output, and bypass standard file metadata checks. While CVE-2026-64600 itself is strictly local, successful exploitation on a compromised host could enable attackers to establish persistence, manipulate credentials, or facilitate lateral movement within a network. 非特权本地用户可以覆盖启用了 reflink 的 XFS 卷上任何可读文件的磁盘内容。我们的概念验证通过精确修改 /etc/passwd 或 SUID-root 二进制文件，能够稳定地获取主机 root 权限。这些更改在重启后依然存在，不会留下任何内核日志输出，并能绕过标准的文件元数据检查。虽然 CVE-2026-64600 本身仅限于本地，但在受感染主机上的成功利用可能使攻击者能够建立持久性、操纵凭据或促进网络内的横向移动。

Watch a RefluXFS Proof-of-concept Demonstration

观看 RefluXFS 概念验证演示

The following proof-of-concept shown in the video below shows the RefluXFS vulnerability on a default RHEL 10.2 deployment. Starting as an unprivileged local user with no administrative rights, the exploit triggers the race condition to silently overwrite a protected system file at the block layer. Within seconds, the root account’s password protection is stripped, granting immediate, passwordless root access. The modification persists across reboots and leaves no kernel log artifacts. 下方视频中的概念验证展示了 RefluXFS 漏洞在默认 RHEL 10.2 部署中的表现。从一个没有任何管理权限的非特权本地用户开始，该漏洞利用触发了竞争条件，在块层静默覆盖了一个受保护的系统文件。几秒钟内，root 账户的密码保护被剥离，从而立即获得无需密码的 root 访问权限。该修改在重启后依然存在，且不会留下任何内核日志痕迹。

Affected Systems & Prerequisites

受影响系统与先决条件

Vulnerability Scope & Impact: The RefluXFS vulnerability affects systems meeting all three of the following criteria: 漏洞范围与影响：RefluXFS 漏洞影响满足以下所有三个条件的系统：

• Kernel Version: Running Linux kernel v4.11 or later (2017) without the specific security patch.
• 内核版本： 运行 Linux 内核 v4.11 或更高版本（2017 年），且未安装特定安全补丁。
• Filesystem Configuration: Utilizing an XFS filesystem with reflink=1 in its superblock.
• 文件系统配置： 使用在超级块中设置了 reflink=1 的 XFS 文件系统。
• File Structure: The filesystem must contain both a high-value target (a root-owned configuration file or SUID-root binary) and a directory writable by an unprivileged local user.
• 文件结构： 文件系统必须同时包含一个高价值目标（root 拥有的配置文件或 SUID-root 二进制文件）以及一个可由非特权本地用户写入的目录。