ISLAMABAD – Cybersecurity company Qualys has disclosed a critical Linux vulnerability that could allow attackers with a standard local user account to gain full administrative control of affected systems.
The vulnerability, tracked as CVE-2026-64600 and codenamed RefluXFS, affects the Linux kernel’s XFS filesystem and is believed to impact more than 16.4 million systems worldwide.
According to Qualys, the flaw is caused by a race condition within the XFS copy-on-write (CoW) implementation. A race condition occurs when two processes attempt to access or modify shared resources simultaneously, allowing attackers to exploit unexpected timing behaviour.
Vulnerability has existed since 2017
Qualys said the vulnerability has been present since Linux kernel version 4.11, released in 2017.
The issue affects XFS volumes that use reflinks, a storage optimisation feature that allows multiple files to share the same underlying data until modifications are made.
Affected operating systems include:
- Red Hat Enterprise Linux
- Oracle Linux
- Amazon Linux
- Fedora
Systems configured with XFS reflinks are considered vulnerable.
Attackers could obtain root privileges
Researchers warned that an attacker with access to a standard local account could exploit the flaw to overwrite protected system files.
Successful exploitation could result in root access, the highest privilege level available on Linux systems, allowing attackers to modify system files, install software, alter security settings and take full control of the affected machine.
Qualys also noted that the exploit can bypass several common Linux security protections.
Exploitation may remain undetected
According to the researchers, attacks exploiting RefluXFS can modify protected files without generating kernel log entries, making malicious activity more difficult to detect.
The changes also remain in place after a system reboot, increasing the potential impact of successful attacks.
Due to its severity, Qualys has classified RefluXFS as an emergency-priority vulnerability.
AI-assisted research process using Claude
Qualys said the vulnerability was identified during a security research project that used Anthropic’s Claude Mythos Preview to assist with manual code auditing.
Saeed Abbasi, head of the Qualys Threat Research Unit, said artificial intelligence accelerated the review process, while human researchers verified all findings before disclosure.
He added that the vulnerability underwent the company’s standard evidence verification and responsible disclosure procedures.
Organisations urged to install security updates
Qualys has advised organisations to install the latest kernel updates released by their Linux vendors without delay.
The company said systems should be rebooted after applying updates to activate the patched kernel.
It also recommended prioritising internet-facing servers and multi-tenant cloud environments, where exploitation could have wider consequences.
Qualys noted that there are currently no practical temporary mitigations, making security updates the only effective protection.
Key points:
- Qualys has disclosed the critical Linux RefluXFS vulnerability (CVE-2026-64600).
- The flaw could affect more than 16.4 million Linux systems worldwide.
- Attackers with a normal local account may gain full root privileges.
- The vulnerability has existed since Linux kernel version 4.11, released in 2017.
- Red Hat Enterprise Linux, Oracle Linux, Amazon Linux and Fedora systems using XFS reflinks are affected.
- Qualys recommends installing vendor security updates and rebooting systems immediately.
- AI-assisted research using Anthropic’s Claude Mythos Preview helped identify the vulnerability.