A Hidden Linux Flaw Lets Any Local User Seize Full Control of a Machine

Key points

• CVE-2026-64600, nicknamed RefluXFS by Qualys researchers, has been present in Linux kernels since version 4.11 was released in 2017.
• Qualys estimates the flaw affects more than 16.4 million systems, most of them enterprise Linux servers.
• An ordinary, unprivileged user on the same machine can use the flaw to overwrite any readable file, gaining full root (administrator-level) access.
• A patch was merged into the Linux kernel source tree on 16 July 2025; affected organisations must apply it and fully reboot the system.
• Standard Linux security hardening measures, including memory-protection features and SELinux policy enforcement, do not block this particular attack path.

A security flaw in a widely used part of the Linux operating system allows any regular user sitting on the same machine to quietly take complete control of it. No special permissions required. No alarm bells raised in system logs.

The flaw, tracked as CVE-2026-64600 and given the name RefluXFS by the researchers who found it, sits inside XFS, a high-performance filesystem (the software layer that decides how a computer stores and retrieves files on disk). XFS is the default filesystem on Red Hat Enterprise Linux and several other major enterprise distributions.

How does this attack actually work?

An unprivileged local user, meaning someone with a standard account and no administrative rights, can exploit the flaw to overwrite any readable file on the system, including files owned by the root administrator. That opens the door to full system takeover.

The problem lives in a feature called reflink. Reflink lets the operating system create what looks like a copy of a file without physically duplicating the data on disk, saving storage space. Normally, the moment someone tries to change one of those shared copies, XFS first carves out a fresh piece of disk space so the original stays safe. The trouble arises when two write operations hit the same reflinked file at almost exactly the same instant. That timing conflict, called a race condition, confuses XFS into modifying the original file directly on disk instead. The change persists after a reboot and generates no log entry that an administrator would notice.

"Exploitation is highly reliable and leaves no kernel log output," said Saeed Abbasi, head of the Qualys Threat Research Unit, in the team's advisory.

Qualys assigns the flaw a CVSS severity score (a standardised 0-to-10 rating of how dangerous a vulnerability is) of 7.8 out of 10.

Which systems are at risk?

The flaw touches every mainline Linux kernel from version 4.11 onward, covering releases since May 2017.

CloudLinux 8, 9, and 10 are also affected. Systems using the default ext4 or btrfs filesystems instead of XFS are not vulnerable.

Standard defences built into the Linux kernel, including KASLR (memory randomisation that makes it harder to guess where code lives), SMAP, SMEP, and even SELinux policy enforcement, do not stop this attack. The flaw operates at the disk layer, below where those protections apply.

What should organisations do right now?

Patch and reboot. Those are the only reliable fixes, according to Qualys. The upstream kernel fix was merged on 16 July 2025. Major Linux distributors began backporting that patch to their own supported releases shortly afterwards. System administrators should apply the latest kernel update from their Linux vendor and fully restart every affected machine.

Ordinarily, a bug like this needs a network attacker to get in first. RefluXFS requires a local account, which means the realistic threat is a malicious insider, an already-compromised staff account, or a contractor with login access. That makes account hygiene and access reviews a meaningful part of the response, alongside patching.

First reported by CSO Online, the story was confirmed through Qualys's own published advisory.