RefluXFS (CVE-2026-64600): an AI Found the Linux Kernel Root Bug Nine Years of Humans Missed

The interesting thing about CVE-2026-64600 is not that it gives an unprivileged local user root on a default Red Hat install. Linux privilege-escalation bugs surface every few months. The interesting thing is who found it. On 22 July 2026 the Qualys Threat Research Unit disclosed RefluXFS, a race condition that had been sitting in the XFS filesystem's copy-on-write path since kernel 4.11 shipped in 2017 — and the flaw was not caught by a human auditor reading the code. It was caught by a model that was pointed at the kernel and asked to go looking.

That detail reframes the whole disclosure. A nine-year-old memory-safe logic bug, in the default filesystem of the most audited enterprise Linux on earth, survived nearly a decade of human review and fell to a machine on a research run. If that is now a repeatable capability, every organisation should be asking the obvious follow-up: is anyone running that capability against my fleet, and if so, is it me or the attacker?

An AI Found a Nine-Year-Old Kernel Race

Qualys attributes the find to a structured research initiative with Anthropic in which the team folded Claude Mythos Preview — Anthropic's restricted-access frontier model — into a human-led kernel audit workflow. Per Qualys's disclosure and BleepingComputer's reporting, the researchers pointed the model at the XFS subsystem and asked it to find a bug in the same class as Dirty COW — the 2016 copy-on-write race that became one of the most exploited Linux LPEs of the decade. The model located the race, wrote a working root exploit, and drafted the advisory. Humans stayed in the loop and verified everything, but the discovery came from the machine.

This is the part worth sitting with. Dirty COW itself hid in the kernel for roughly eleven years before a human noticed it in 2016. RefluXFS is structurally its cousin — a CoW race — and it hid for nine. The gap between "a class of bug we know exists" and "the specific instance in your running kernel" is exactly the gap that manual review keeps failing to close, because a human cannot re-audit millions of lines of concurrent kernel code on every commit. A model can be pointed at that surface and told to hunt a known pattern. RefluXFS is the first widely-covered case of that loop producing a genuine, weaponised, enterprise-wide root bug.

How RefluXFS Turns an XFS Reflink Race Into Root

The mechanism is a textbook time-of-check/time-of-use failure in the XFS reflink (block-sharing) path. When two O_DIRECT writes target the same reflinked file, the kernel briefly drops the inode lock while it waits for space in the transaction log. In that window a second writer can complete its own remap and change the reference state of the original block. When the first writer wakes up, it trusts the now-stale metadata and writes directly to the original shared block instead of allocating a private copy — which is the entire point of copy-on-write.

The consequence is that an ordinary local user can overwrite the on-disk contents of any file they can read on an affected XFS volume. Point that primitive at a root-owned file with predictable contents — a setuid binary, a systemd unit, /etc/passwd — and you have root. Qualys reports the race typically wins in under ten seconds and that its exploit was reliable under standard hardening. The company released a proof-of-concept description via the oss-security list but withheld the working exploit code.

The condition to be vulnerable is narrow to state and wide in practice: the kernel is 4.11 or newer and the target filesystem is XFS with reflink enabled — which has been the default on enterprise distributions for years.

Why RefluXFS Is Invisible: It Lives Below the Layer Your Defenses Watch

Most of your detection stack is aimed at the wrong altitude for this bug. RefluXFS does not corrupt memory, so KASLR, SMEP and SMAP — the mitigations that stop the usual kernel exploit — simply do not apply. The write lands at the filesystem allocation layer, beneath them. Qualys reports that in testing the exploit succeeded with SELinux in Enforcing mode, with kernel lockdown on, with seccomp filters, and from inside container boundaries. None of those stopped it.

Worse for anyone hoping to catch it after the fact:

• The malicious write produces no kernel warning and no log entry — it looks like ordinary filesystem I/O.
• The on-disk modification survives a reboot, because it is on disk, not in a running process.
• There is no memory-corruption crash signature for an EDR to trip on.

"Show me the log line for the compromise." There isn't one. The exploit overwrote a root-owned file through a legitimate filesystem path and left. Your host-based tooling watched a local process do local file I/O and had no reason to flag it.

That is the uncomfortable property of block-layer LPEs: the host is the crime scene and the only witness, and it saw nothing. Post-incident, an integrity baseline might tell you a file changed — but only if you had one before the attacker did.

The 16.4-Million-System Blast Radius

Using its asset-inventory telemetry, Qualys estimates RefluXFS potentially affects more than 16.4 million systems worldwide. The exposure map is essentially "modern enterprise Linux with default storage":

• RHEL 8, 9, 10 and the RHEL-family rebuilds — Rocky, AlmaLinux, Oracle Linux, CloudLinux (8/9/10)
• CentOS Stream 8/9/10
• Fedora Server 31 and later
• Amazon Linux 2023 and Amazon Linux 2 (December 2022 kernels onward)

RHEL 7 is not affected — it predates XFS reflink support. That is the one piece of good news, and it is cold comfort for anyone who spent the last three years migrating off it.

At disclosure there was no CVSS score assigned and no in-the-wild exploitation reported, and RefluXFS is not yet on the CISA KEV catalog. Treat none of that as reassurance. A working exploit exists, the technique is now publicly described, and LPEs are the second half of nearly every real intrusion: the phish or the web RCE gets an attacker a shell, and a bug like this turns that shell into root. The window between "described" and "weaponised in a commodity toolkit" for a reliable Linux root primitive is measured in days.

Remediation

RefluXFS cannot be hardened around, isolated, or configured away — the reflink prerequisite cannot be disabled on an existing filesystem, and every memory and mandatory-access-control mitigation is bypassed. Patching the kernel and rebooting is the fix. Verify every CVE-specific version against the authoritative Red Hat advisory for CVE-2026-64600 for your exact stream before you act on the numbers below.

1. Am I affected? Two conditions must both hold. Check the kernel and the filesystem:

uname -r                       # 4.11 or newer → in range
xfs_info / | grep reflink=     # reflink=1 → the exploit prerequisite is met

Repeat the xfs_info check for every mounted XFS volume that unprivileged users can write into, not just /. If reflink=1 appears and the kernel is unpatched, treat the host as exploitable. RHEL 7 hosts are out of scope.

2. Patch — exact fixed versions. The fix is upstream commit 2f4acd0…, merged 16 July 2026. Tested fixed builds per stream:

Stream	Fixed kernel	Advisory
RHEL/EL 8.10	4.18.0-553.144.1.el8_10	RHSA-2026:39179 / 39180
RHEL/EL 9.8	5.14.0-687.26.1.el9_8	RHEL 9 errata, 14–17 Jul 2026
RHEL/EL 10.2	6.12.0-211.34.1.el10_2	RHSA-2026:39494
Debian trixie	6.12.96-1	trixie-security

Coverage is stream-specific — a nearby version number is not proof of the fix. Confirm the exact errata for your point release. A reboot is mandatory: installing the package does not replace the running kernel, and RefluXFS lives in the running kernel.

3. Can't patch now? Compensating controls. There is no clean mitigation, but two stopgaps exist for hosts that cannot reboot immediately:

• Red Hat published a SystemTap runtime mitigation that intercepts the reflink operation. Treat it as a temporary bandage, not a fix.
• Rebootless live-patching (e.g. KernelCare) covers EL8/EL9 and is rolling out for EL10 and Oracle UEK.

Neither substitutes for a patched, rebooted kernel. Prioritise multi-tenant hosts, CI runners, and any box where untrusted or semi-trusted users hold local shells — those are where an LPE pays off.

4. Hunt for compromise. There are no clean network IOCs — this is a local, log-silent exploit (MITRE ATT&CK T1068, Exploitation for Privilege Escalation, with defense evasion T1070, indicator removal). Hunt for the effects, not the exploit:

• Run rpm -Va and compare against known-good hashes — an overwritten package-owned root file (a setuid binary, a shipped config) shows as a checksum mismatch.
• Watch /etc/passwd, /etc/shadow, /etc/sudoers.d/, systemd unit directories and cron paths with auditd/IMA for unexpected writes (T1098 account manipulation, T1543 systemd persistence, T1053 cron).
• Correlate the surrounding activity: how did a local user get on the box, and what did that identity do on the network before and after? The LPE is silent, but the initial access and the post-root lateral movement are not.

5. Eradicate + verify. If integrity checks flag a modified root file: rebuild rather than repair where the box permitted untrusted local access, rotate any credential the attacker could have read as root (SSH host keys, service tokens, cached cloud credentials), remove unexpected persistence, then confirm the host booted into the patched kernel with uname -r.

What a Nine-Year Latent Root Bug Says About Validation

Two facts from this disclosure belong together. First: a model, pointed at a code surface and told to hunt a known bug class, produced a reliable enterprise-wide root exploit that human review missed for nine years. Second: that exploit leaves no host-side evidence, so you cannot detect it after the fact — you can only find out whether your systems are exploitable before someone uses it, by trying.

That is the exact problem Zero Hunt's AI generative pentest was built for. The platform's 10-agent swarm runs continuously and on-prem, and its Post-Exploit and Pivot agents operate on the same assumed-breach premise RefluXFS demands: given a foothold, can we actually reach root on this host, with its kernel and filesystem layout — not a version-banner guess, but a proven chain. Every exploit is generated per target by a local LLM and backtested in the AI Gym against the Vulhub and CVE-based corpora before it is ever allowed near a production asset, so the validation itself is safe. Each finding is ECDSA-signed with chain-of-custody, so "we confirmed this box was exploitable and then fixed it" is an evidence artefact, not a claim. And it is the same underlying capability that found RefluXFS — a model reasoning about code and building the exploit — turned to face inward, on your infrastructure, on your schedule, instead of an attacker's.

The traffic side closes the gap RefluXFS opens on the host. Because the LPE itself is invisible locally, the only place the intrusion leaves a trace is the wire — the initial foothold that dropped the exploit, and the lateral movement after root. Zero Hunt's AI Traffic Analysis, a deep-learning model with four inference heads running at 2.7+ Gbit/s on the appliance GPU, watches for exactly that: the anomalous session that put a local user on a box that historically had none, and the fan-out that follows a quiet privilege escalation. When the host goes blind, the network is what still sees.

An AI found this one in a lab. The only question that matters now is whether an AI is checking your fleet before an attacker's does.