This Linux bug has quietly handed out root access since 2017 — and it leaves zero trace

Qualys just named a nine-year-old race condition in XFS that turns any local login into root, and the disk never shows it happened. Aliteq Priya Nair · Software & Systems Editor

CVE-2026-64600 (RefluXFS) is a race condition in XFS's copy-on-write path, present in every Linux kernel since 4.11 (2017).

It requires XFS mounted with reflink=1 and a writable directory on the same filesystem as a root-owned target — a default setup on several major enterprise distros.

CVSS score is 7.8. Qualys estimates it affects more than 16.4 million systems worldwide.

The exploit survives reboots and writes to disk with no kernel log entry — a compromised SUID binary keeps its SUID bit and looks untouched.

A working proof of concept is already public. Vendor kernel patches are out, but they require a reboot to actually take effect.

The CVSS 7.8 undersells this one. A 7.8 local-only score is the kind of number that gets triaged behind a 9-point remote RCE — but on shared hosting, CI runners, university clusters, or any box…

Read the full story

Aliteq This Linux bug has quietly handed out root access since 2017 — and it leaves zero trace Read the full story on Aliteq