CVE-2026-64600Disclosure(linux / linux_kernel)

CRITICALCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 29 mentions and remains active

Immediate actions

Patch linux linux_kernel systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

linux CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-362

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

linux_kernel

Threat summary

Active exploitation appears in 3 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
77 mentions across 18 observed days

What's happening

Active exploitation reported across 3 signals
Exploit tool or code specified in 6 signals
PoC mentioned or linked in 14 signals
Patch or workaround mentioned in 26 signals
Technical details provided in 65 signals
Disclosure: 40 classified signals
General: 13 classified signals
Peaked 16d ago at 29 mentions (2026-07-23); latest day: 1
77 total mentions across 18 days

Affected systems

Vendors

linux

Products

linux_kernel

1 version affected across 1 product

Deep dive

Activity timeline77 mentions / 18d

Signal classification6 categories

Disclosure

4051.9%

Patch

1519.5%

General

1316.9%

PoC

56.5%

Active Exploitation

22.6%

Exploit

22.6%

Referenced assets52 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-22	9	Disclosure6General2Patch1
2026-07-23	29	Active Exploitation1Disclosure15General4Patch8PoC1
2026-07-24	12	Active Exploitation1Disclosure7General2Patch2
2026-07-25	3	Disclosure2Exploit1
2026-07-26	1	Patch1
2026-07-27	6	Disclosure5Patch1
2026-07-28	1	Patch1
2026-07-30	5	Disclosure1General1Patch1PoC2
2026-07-31	2	Disclosure1PoC1
2026-08-01	1	Disclosure1
2026-08-02	1	General1
2026-08-04	1	Disclosure1
2026-08-14	1	PoC1
2026-08-18	1	Disclosure1
2026-08-19	1	General1
2026-08-21	1	General1
2026-09-15	1	General1
2026-09-23	1	Exploit1

Full discourse20 posts

portbuster@portbuster133728d
Exploit
lpe-toolkit has been updated with new LPE exploits! New exploits added: - RefluXFS CVE-2026-64600 - CrackArmor CVE-2026-23268 - skb_shift CVE-2026-43503 - GRO Flag Loss CVE-2026-43503 - snap-confine CVE-2026-8933 https://github.com/portbuster1337/lpe-toolkit/releases/tag/v1.4.0
Post summary
The post advertises an updated LPE exploit toolkit and lists several new CVE-specific exploits with a GitHub release link. The main focus is exploit tooling rather than active exploitation, patches, or debunking.
0230112668.6K
425 followersView on X
0xSEC@xeroxsec83d
PoC
Published a blog explaining CVE-2026-64600: RefluXFS Linux Kernel Flaw Leads to Root Privilege Escalation with source code reference and also attached PoC for it. It took some time to write the exploit. Enjoy :) https://0xsec.gitbook.io/0xsec/blogs/cve-2026-64600-refluxfs-linux-kernel-flaw-leads-to-root-privilege-escalation #cve #linux #kernel
Post summary
The post discloses CVE‑2026‑64600, details a Linux kernel privilege‑escalation flaw, and provides a PoC exploit with source code.
012150163.0K
411 followersView on X
ThreatWire@ThreatWire_83d
PoC
🚨 A public PoC is available for CVE-2026-64600, a Linux kernel vulnerability affecting XFS. The flaw involves stale data fork mappings after an ILOCK cycle, potentially impacting filesystem integrity. 🔗 https://github.com/litosmartin/cve-2026-64600-refluxfs-poc #Linux #XFS #CVE #CyberSecurity
Post summary
A public proof‑of‑concept for CVE‑2026‑64600 affecting XFS has been released, including technical details about stale data fork mappings. No evidence of active exploitation or patch is provided.
111036121.9K
1.7K followersView on X
Anderson Nascimento@andersonc0d391d
Disclosure
RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) https://seclists.org/oss-sec/2026/q3/214
Post summary
A new vulnerability, CVE-2026-64600, has been disclosed, revealing a local privilege escalation flaw in the Linux kernel that exploits an XFS reflink race condition.
0202681.6K
4.5K followersView on X
yousukezan@yousukezan91d
Disclosure
LinuxカーネルのXFSファイルシステムに、一般ユーザーがroot権限を取得できる権限昇格の脆弱性「RefluXFS」（CVE-2026-64600）が見つかった。Qualysは世界で1,640万台以上が影響を受ける可能性があると推定しており、カーネル更新を最優先で実施するよう呼びかけている。脆弱性は、XFSのCopy-on-Write（CoW）処理に存在する競合状態（レースコンディション）に起因する。攻撃者は一般権限でSUID付き実行ファイルをreflink機能で複製した後、その複製ファイルに対して2つの直接I/O書き込みを競合させる。ログ領域の確保待ちでカーネルがinodeロックを解放する間に、古いブロックアドレスが参照カウントの検査を通過し、本来ではなく元ファイルの物理ブロックへ書き込みが行われる。この変更はディスクへ直接反映され、再起動後も残るほか、カーネルログも出力されず、SUIDファイルの属性も維持されるという。影響を受けるのは2017年公開のLinuxカーネル4.11以降で、XFSのreflink機能を使用するファイルシステムが対象となる。RHEL、Oracle Linux、Amazon Linux、Fedora ServerではXFSが標準で利用されるため影響が大きい一方、Debian、Ubuntu、SUSEは標準ではXFSを使用せず、管理者がreflink対応XFSを選択した場合のみ影響を受ける。現時点で実際の悪用は確認されていないが、Qualysは動作するPoCを作成しており、回避策はなくカーネル更新のみが有効な対策としている。 https://securityonline.info/refluxfs-cve-2026-64600-xfs-root/
Post summary
A newly disclosed privilege‑escalation flaw in Linux kernel XFS (CVE‑2026‑64600) is detailed, with a working PoC released by Qualys but no confirmed attacks, and only kernel updates are advised as mitigation.
0501482.1K
14.9K followersView on X
connect24h@connect24h90d
Disclosure
9年も眠っていたとは、さすがに笑えない。 RefluXFS（CVE-2026-64600）は、XFSのrace conditionで非特権local userが読めるroot所有ファイルをディスク上で上書きし、rootを奪える。kernel 4.11以降かつreflink=1が条件で、RHEL 8/9/10の新規標準構成は直撃する。Qualysは1,640万台超に影響する可能性を指摘。SELinux Enforcingでも止まらず、改変は再起動後も残り、kernel logにも出ない。正直、現場ではかなり嫌な穴だ。自分なら全ホストで「xfs_info / | grep reflink=」を回す。1ならvendor提供の修正済みkernelへ更新し、再起動後に「uname -r」で稼働kernelを照合してほしい。CSIRTの初動用に保存推奨。 #セキュリティソース: https://www.bleepingcomputer.com/news/linux/new-refluxfs-linux-flaw-lets-attackers-gain-root-privileges/
Post summary
The post announces a new XFS race condition CVE-2026-64600, details its impact and technical aspects, warns of widespread risk, and recommends applying the vendor‑supplied kernel patch.
05089917
7.0K followersView on X
IT-Connect.fr@ITConnect_fr87d
Disclosure
⚠️ RefluXFS : cette faille dans XFS donne un accès root sur RHEL, CentOS et AlmaLinux Plus d'infos par ici : - https://www.it-connect.fr/refluxfs-cve-2026-64600-faille-xfs-acces-root-linux/ #infosec #linux #cybersecurite https://t.co/T6jGR3FACQ
Post summary
The tweet highlights the discovery of CVE-2026-64600, a flaw in the XFS filesystem that could allow an attacker to gain root privileges on RHEL, CentOS, and AlmaLinux, and links to a detailed article.
0601121.2K
11.6K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi87d
Patch
ثغرة جديدة في Linux Kernel ممكن ترفع صلاحيات مستخدم محلي إلى root. رقم الثغرة CVE-2026-64600 وموجودة داخل مسار XFS reflink. إذا عندك سيرفرات Linux تستخدم XFS حدث انظمتك في اقرب وقت. https://t.co/yaezTDIM8Y
Post summary
A new local privilege escalation vulnerability (CVE‑2026‑64600) affecting Linux XFS reflink has been identified; users are advised to patch promptly.
1101051.8K
50.2K followersView on X
Gate and Kernel@insidecomput83d
Disclosure
AI just found a Linux root vulnerability that had been hiding for nearly 9 years. https://youtu.be/pIvI61o5Odo RefluXFS, CVE-2026-64600, abuses a race condition in XFS reflink and Copy-on-Write. A normal local user may be able to overwrite protected files and gain root access. The age of AI-assisted kernel bug hunting has arrived. #Linux #CyberSecurity #AI #RefluXFS #XFS
Post summary
The post announces that an AI‑based tool discovered CVE‑2026‑64600, a race condition in XFS that can lead to local privilege escalation, but provides no PoC, exploit code, or patch details.
23072495
17.6K followersView on X
dbugs@ptdbugs84d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-64600 PT ID: PT-2026-63570 Vendor: Linux Product: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-63570 • https://github.com/litosmartin/cve-2026-64600-refluxfs-poc #dbugs_vuln
Post summary
A proof of concept for CVE-2026-64600 has been published, detailing a race condition in Linux XFS handling, but there is no evidence of active exploitation or vendor patch information.
040521.1K
3.6K followersView on X
Daily CyberSecurity@Daily_CyberSec91d
Disclosure
Qualys discloses CVE-2026-64600 (RefluXFS), an XFS privilege escalation to root affecting 16.4M+ Linux systems. Patch the kernel and reboot now. #RefluXFS #CVE202664600 #LinuxKernel #PrivilegeEscalation #XFS #InfoSec http://securityonline.info/refluxfs-cve-2026-64600-xfs-root/
Post summary
Qualys discloses CVE-2026-64600, a privilege‑escalation flaw in the XFS filesystem affecting over 16 million Linux systems, and urges immediate kernel patching and reboot.
02063573
12.9K followersView on X
iototsecnews@iototsecnews84d
Disclosure
Linux Kernel の深刻な脆弱性 RefluXFS CVE-2026-64600：root アクセス経路を Claude Mythos が特定 https://iototsecnews.jp/2026/07/23/critical-refluxfs-linux-kernel-flaw-lets-local-attackers-gain-root-access/ Linux カーネルのファイル管理機能において、処理が重なるタイミングの不備に起因する深刻な脆弱性 CVE-2026-64600 が公表されました。権限を持たない利用者であっても、システム上の重要な情報を書き換え、管理者の権限を奪ってしまう危険性があります。一般的な保護設定だけでは悪用を防ぎきれないため、安全に利用するためにも、各開発元から提供される修正済みのプログラムへ速やかに更新し、システムを再起動して新しい状態を反映させることが必要です。 #CVE202664600 #Kernel #Linux #Vulnerability
Post summary
The post announces a critical Linux kernel flaw (CVE‑2026‑64600) that allows local privilege escalation via a race condition, and urges administrators to apply vendor patches immediately.
12060572
513 followersView on X
Open Source Security mailing list@oss_security82d
Disclosure
CVE-2026-64600,RefluXFS: Linux kernel: Local Privilege Escalation via XFS reflink direct-I/O race https://www.openwall.com/lists/oss-security/2026/07/22/14 @Qualys Security Advisory by Mythos Foreword Summary Am I affected? Background: XFS, reflink, and copy-on-write Analysis Exploitation Acknowledgments Timeline
Post summary
CVE-2026-64600 describes a local privilege escalation in the Linux kernel using an XFS reflink race condition; the announcement links to a discussion but does not provide a PoC, exploit code, patch, or active exploitation evidence.
01051878
4.7K followersView on X
CloudSecurityAlliance@cloudsa90d
Active Exploitation
CISO Daily Briefing: Two OpenAI eval models escaped their sandbox and compromised Hugging Face — ~17,000 autonomous actions before detection. Technical: Check Point SmartConsole auth bypass (CVE-2026-16232, CVSS 9.1) is now in CISA KEV; a 9-yr-old Linux XFS flaw (CVE-2026-64600) gives root on 16.4M systems; MemGhost plants false memories in AI agents at 87.5%. Governance: Google's FARO floats a FINRA-style AI regulator, backed by Altman, Nadella, Musk & Anthropic. https://labs.cloudsecurityalliance.org/research/ciso-daily-briefing-20260723/
Post summary
The briefing notes that the Check Point SmartConsole auth bypass (CVE-2026-16232) is now listed in CISA’s KEV, signaling active exploitation in the wild, while also describing other high‑severity vulnerabilities such as a Linux XFS flaw giving root to millions of systems.
00043652
18.9K followersView on X
GovCERT.CZ@GOVCERT_CZ90d
Patch
🚨 Upozorňujeme na zranitelnost v RefluXFS v Linux Kernel XFS Filesystem, CVE-2026-64600. Jedná se o kritickou lokální eskalaci oprávnění v implementaci XFS souborového systému v linuxovém jádře, konkrétně v mechanismu copy-on-write/reflink, která umožňuje lokálnímu neprivilegovanému útočníkovi získat root oprávnění zneužitím race condition při souběžných direct I/O operacích nad reflink-enabled soubory. Během zpracování XFS dočasně uvolňuje inode lock při čekání na prostor v transakčním logu, čehož může útočník využít ke změně mapování bloků před pokračováním původního zápisu; následná operace pak chybně předpokládá, že blok je privátní, a zapisuje přímo do sdílených bloků, což může vést k libovolnému přepsání on-disk bloků legitimních souborů, perzistentní modifikaci souborového systému a eskalaci oprávnění. Zranitelnost se týká systémů s Linux kernelem 4.11 a novějším před aplikací záplat, které používají XFS souborový systém se zapnutou podporou reflink a kde mají lokální uživatelé právo zápisu alespoň do jednoho adresáře na dotčeném souborovém systému; mezi potvrzeně dotčené distribuce patří RHEL 8, RHEL 9, RHEL 10, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Amazon Linux a Fedora Server 31 a novější, potenciálně také Debian, Ubuntu a SUSE Linux při použití XFS s reflink podporou. 📌Doporučujeme aktualizovat na nejnovější verzi.
Post summary
The post discloses a critical local privilege escalation in XFS copy‑on‑write and urges systems to apply the latest kernel update for mitigation.
011311.0K
4.3K followersView on X
Upwind Security MDR@UpwindMDR88d
Disclosure
⚠️ MEDIUM - Linux kernel XFS reflink stale data fork mapping leads to incorrect refcount checks (CVE-2026-64600) A flaw in the Linux kernel’s XFS reflink code can leave a stale data fork mapping after cycling the inode lock (ILOCK) to start a transaction, causing refcount btree queries to operate on the wrong physical blocks. The root cause is a race/stale state issue due to improper synchronization and failure to refresh mapping when the sequence counter changes across the ILOCK cycle. An attacker who can trigger XFS reflink + direct I/O workloads under the right timing conditions can exploit this by forcing writes to proceed using stale mapping information. Impact includes filesystem integrity issues and potential data corruption due to incorrect shared-state decisions during direct I/O. 👉 Affected: Linux kernel (XFS reflink) | Upgrade to a kernel version including the fix to resample data fork mapping on seqcount change
Post summary
The text announces a medium‑severity Linux kernel XFS reflink flaw that can cause stale mapping and data corruption, and recommends upgrading to a patched kernel version.
01011138
254 followersView on X
Leonel Marin@LeonelM4126210789d
Disclosure
🐧 𝗔𝗟𝗘𝗥𝗧𝗔 𝗟𝗜𝗡𝗨𝗫: 2 fallas críticas de escalamiento de privilegios 🔹 CVE-2026-8933 → Ubuntu Desktop 🔹 CVE-2026-64600 "RefluXFS" → RHEL, CentOS, Rocky, AlmaLinux, Fedora, Amazon Linux Más info 👇👇 https://whatsapp.com/channel/0029VassZ6m7z4kmqDvFZg07/399 #Ciberseguridad #Linux #Colombia https://t.co/CigQfw3Wyv
Post summary
The tweet announces two new critical privilege‑escalation CVEs affecting multiple Linux distributions, without providing PoC, exploit code, or patch information.
02010165
26 followersView on X
Cert-IST@cert_ist90d
Disclosure
RefluXFS, une nouvelle faille du noyau Linux dévoilée le 22 juillet et identifiée comme CVE-2026-64600, permet à un utilisateur local sans privilège d'écraser des fichiers root sur un système de fichiers XFS et d'obtenir un accès root persistant. https://tinyurl.com/4ayhahv5
Post summary
The text announces the discovery of a new Linux kernel flaw, CVE-2026‑64600, which allows local privilege escalation on XFS filesystems by permitting unprivileged users to overwrite root files and gain persistent root access.
01020191
961 followersView on X
Nullvy CyberNews@ncnarabic91d
Disclosure
كشف باحثو كواليس عن ثغرة جديدة في نواة لينكس تحمل المعرّف CVE-2026-64600، تتيح للمستخدم المحلي الحصول على صلاحيات الرووت والسيطرة الكاملة على النظام. 📌 للتفاصيل الكاملة: 🔗 https://www.instagram.com/p/DbIW9eyIuYC/?igsh=MXNsNmJjZTB5MzA4cQ== #ثغرات #لينكس https://t.co/0IiBULzZKb
Post summary
The post announces the discovery of a new Linux kernel privilege‑escalation flaw (CVE‑2026‑64600) that allows local users to gain root access, but it does not provide an exploit, patch, or evidence of active exploitation.
0003088
24 followersView on X
Es Geeks@EsGeeks91d
Patch
🚨 REFLUXFS (CVE-2026-64600): race condition en XFS del kernel Linux da root local sin logs, incluso con SELinux. Existe desde 4.11. Actualiza ya si usas RHEL/Alma/Rocky. #Linux #CVE #Ciberseguridad https://t.co/gjwf2YSgjU
Post summary
The tweet announces a Linux kernel race condition vulnerability (CVE-2026-64600) and urges affected users to apply the available patch.
10011676
22.2K followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	linux	linux_kernel	-	-	-
OS	linux	linux_kernel	7.2	-	-
OS	linux	linux_kernel	7.2	-	-
OS	linux	linux_kernel	7.2	-	-

Explore more

Back to dashboard linux CVEs linux_kernel vulnerabilities

What researchers are saying

CVE-2026-64600

ThreatWire[verified]@ThreatWire_PoC

A public proof‑of‑concept for CVE‑2026‑64600 affecting XFS has been released, including technical details about stale data fork mappings. No evidence of active exploitation or patch is provided.

Anderson Nascimento[verified]@andersonc0d3Disclosure

A new vulnerability, CVE-2026-64600, has been disclosed, revealing a local privilege escalation flaw in the Linux kernel that exploits an XFS reflink race condition.

yousukezan[verified]@yousukezanDisclosure

A newly disclosed privilege‑escalation flaw in Linux kernel XFS (CVE‑2026‑64600) is detailed, with a working PoC released by Qualys but no confirmed attacks, and only kernel updates are advised as mitigation.

connect24h[verified]@connect24hDisclosure

The post announces a new XFS race condition CVE-2026-64600, details its impact and technical aspects, warns of widespread risk, and recommends applying the vendor‑supplied kernel patch.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediPatch

A new local privilege escalation vulnerability (CVE‑2026‑64600) affecting Linux XFS reflink has been identified; users are advised to patch promptly.

Gate and Kernel[verified]@insidecomputDisclosure

The post announces that an AI‑based tool discovered CVE‑2026‑64600, a race condition in XFS that can lead to local privilege escalation, but provides no PoC, exploit code, or patch details.

dbugs[verified]@ptdbugsPoC

A proof of concept for CVE-2026-64600 has been published, detailing a race condition in Linux XFS handling, but there is no evidence of active exploitation or vendor patch information.

CloudSecurityAlliance[verified]@cloudsaActive Exploitation

The briefing notes that the Check Point SmartConsole auth bypass (CVE-2026-16232) is now listed in CISA’s KEV, signaling active exploitation in the wild, while also describing other high‑severity vulnerabilities such as a Linux XFS flaw giving root to millions of systems.