RESEARCHERS at Qualys have disclosed a nine‑year‑old local privilege escalation in the XFS filesystem, tracked as CVE-2026-64600, that affects default installations of Red Hat Enterprise Linux. The flaw resides in the RefluxFS layer and allows an unprivileged user to overwrite protected files and gain root access.
The vulnerability stems from a race condition in the RefluxFS code that handles delayed allocation, enabling a low‑privileged process to replace a privileged inode before checks are completed. Although the Common Vulnerability Scoring System score has not been released, the issue has been present in the kernel for roughly nine years, impacting many stable releases. Exploitation requires local access but does not depend on any special privileges beyond a standard user account.
Red Hat Enterprise Linux and its downstream clones are the primary systems at risk, with estimates suggesting more than 16.4 million machines could be exposed. The flaw persists in the default XFS configuration used by these distributions, and no vendor‑specific patch has yet been released in their kernel streams. A fix has been merged into the mainline Linux kernel, awaiting backport by Red Hat and its affiliates.
To date there are no reports of the flaw being exploited in the wild, and no threat actor has been linked to attempts, though a public proof‑of‑concept demonstrates the race condition. Security researchers note that because the attack operates below standard memory protection mechanisms, traditional sandboxing and SELinux policies do not block it. Nevertheless, the presence of a working exploit means local malicious users could elevate their privileges if they gain shell access.
Administrators should apply the latest kernel updates from Red Hat as soon as they become available, which will incorporate the backported fix; see the SecurityOnline analysis for details on the patch timeline. Monitoring for unexpected file modifications in privileged directories can help detect attempted exploitation until a patch is applied. Where immediate updating is not feasible, consider limiting user access to XFS mounts or switching to an alternative filesystem temporarily. Maintaining up‑to‑date vulnerability management processes will reduce the window of exposure for similar long‑standing issues.
Further details and mitigation guidance are available in the original Qualys advisory and the accompanying analysis posted by security outlets. Staying informed through Red Hat security errata and the Linux kernel mailing list will ensure administrators receive timely updates. Proactive patching remains the most effective defence against this newly disclosed local privilege escalation.