Nine-Year-Old Linux Flaw Gives Local Users Root Access

Exploiting the Flaw

A newly disclosed Linux kernel vulnerability, CVE-2026-64600, or RefluXFS, allows unprivileged local users to gain root access on default Red Hat Enterprise Linux installations. The flaw was disclosed on July 22. It affects XFS filesystems.

The vulnerability lets users overwrite root-owned files, gaining persistent root access. Qualys researchers discovered the issue, which has gone unnoticed for nine years. Default installations of Fedora Server and other Red Hat derivatives are also vulnerable.

Can Linux Distributions Mitigate the Risk?

RefluXFS is particularly concerning because it can be exploited by local users without requiring elevated privileges. The vulnerability is present in the XFS filesystem, widely used in Linux distributions. An attacker can exploit this flaw to gain root access, potentially leading to a complete system compromise.

The researchers found that the vulnerability is due to a flaw in the XFS filesystem's handling of file permissions. This allows an unprivileged user to modify files owned by the root user.

Linux distributions that use the XFS filesystem are affected, but the ease of exploitation varies. Red Hat has released patches to address the vulnerability. Users of affected distributions should apply these patches as soon as possible to prevent potential attacks.

Frequently Asked Questions

The discovery of RefluXFS highlights the importance of ongoing security audits and vulnerability assessments in Linux distributions. As Linux is widely used in servers and critical infrastructure, vulnerabilities like RefluXFS pose significant risks.

What is RefluXFS? RefluXFS is a Linux kernel vulnerability that allows unprivileged local users to gain root access on systems using the XFS filesystem. Are all Linux distributions affected? No, only distributions that use the XFS filesystem are vulnerable, such as Red Hat Enterprise Linux and Fedora Server. How can users protect themselves? Users can protect themselves by applying patches released by their Linux distribution, such as those provided by Red Hat.