Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

A newly disclosed nine-year-old Linux kernel flaw, RefluXFS (CVE-2026-64600), allows unprivileged local users to achieve persistent root access on default Red Hat Enterprise Linux (RHEL), Fedora Server, and Amazon Linux installations.

Technical Breakdown

• Vulnerability: RefluXFS (CVE-2026-64600), a race condition within the Linux kernel's handling of XFS filesystems.
• TTPs: Local Privilege Escalation (TA0004). An unprivileged local user can exploit this flaw to overwrite root-owned files, leading to persistent root access (T1068).
• Affected Systems: Default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux.

Defense

Patching affected Linux kernel versions is critical to mitigate this local privilege escalation vector.

Source: https://thehackernews.com/2026/07/nine-year-old-refluxfs-linux-flaw-gives.html