Critical Local Privilege Escalation in Linux XFS (CVE‑2026‑64600) Enables Persistent Root Access
What It Is – A race‑condition flaw in the XFS filesystem’s copy‑on‑write allocation path allows a local, unprivileged user to overwrite arbitrary root‑owned files and gain persistent root privileges. The vulnerability, dubbed RefluXFS, is tracked as CVE‑2026‑64600.
Exploitability – Public proof‑of‑concept exists; exploitation is described as “highly reliable,” leaves no kernel log output, and survives a reboot. CVSS (when published) is expected to be ≥ 8.0.
Affected Products – All Linux distributions that ship the XFS filesystem with reflink enabled on kernels ≥ 4.11, including Red Hat Enterprise Linux, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux (≈ 16.4 M systems).
Why It Matters for Compliance & Audit Readiness
- Control Mapping – The flaw maps to SOC 2 CC6.1 (System Operations) and CC7.1 (Change Management); evidence of timely patching is required to demonstrate effective control execution.
- Continuous Evidence – Without automated inventory and patch‑status collection, organizations cannot prove they remediate critical kernel bugs, a common audit query for cloud‑hosted workloads.
- Defensible Audit Trail – The ability of the exploit to evade standard kernel logging means traditional log‑based detection is insufficient; auditors will look for configuration hardening and proof of remediation.
Recommended Actions
- Deploy the kernel patch released on July 16 2026 (commit 2f4acd0) across all XFS‑based hosts.
- If reflink is not required, disable it to reduce the attack surface.
- Update your asset inventory and enable continuous compliance monitoring to capture patch‑status as audit evidence.
- Verify that SOC 2 controls for system operations and change management reflect the remediation.
Source: BleepingComputer – New RefluXFS Linux flaw lets attackers gain root privileges