CVE detail
CVE-2026-64600
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 29.4 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 18
- within the 30d window
- Peak daily
- 14
- highest bucket
Evidence
Source links by recency
18 source links · newest first
Information published.
vendormsrc.microsoft.comJul 24, 2026, 8:02 AMat use XFS with reflink enabled by default. Race winner gets root in buggy file operation The vulnerability, tracked as CVE-2026-64600 , stemmed from the way XFS handles copy-on-write operations for reflinked files. Normally, when two files share the same storage block, as in the case of an original file and the reflinked clone, XFS allocates a new sto
newswww.csoonline.comJul 23, 2026, 3:45 PM- New RefluXFS Linux flaw lets attackers gain root privilegesBleepingComputer
A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges. [...]
newswww.bleepingcomputer.comJul 23, 2026, 11:40 AM RefluXFS, a Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Ama
newsthehackernews.comJul 23, 2026, 8:04 AMNo excerpt available.
Patchgit.kernel.orgJul 23, 2026, 6:16 AMNo excerpt available.
Patchgit.kernel.orgJul 23, 2026, 6:16 AMNo excerpt available.
Patchgit.kernel.orgJul 23, 2026, 6:16 AM- https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txtcdn2.qualys.com
No excerpt available.
Third Party Advisorycdn2.qualys.comJul 23, 2026, 6:16 AM - http://www.openwall.com/lists/oss-security/2026/07/22/19www.openwall.com
No excerpt available.
Exploitwww.openwall.comJul 23, 2026, 6:16 AM - http://www.openwall.com/lists/oss-security/2026/07/22/18www.openwall.com
No excerpt available.
Exploitwww.openwall.comJul 23, 2026, 6:16 AM - http://www.openwall.com/lists/oss-security/2026/07/22/14www.openwall.com
No excerpt available.
Exploitwww.openwall.comJul 23, 2026, 6:16 AM No excerpt available.
Patchgit.kernel.orgJul 23, 2026, 6:16 AMNo excerpt available.
Patchgit.kernel.orgJul 23, 2026, 6:16 AMNo excerpt available.
Patchgit.kernel.orgJul 23, 2026, 6:16 AMNo excerpt available.
Patchgit.kernel.orgJul 23, 2026, 6:16 AMLinked URL: https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600 | Posted by garyhtou | 6 points | 0 comments
communitynews.ycombinator.comJul 22, 2026, 10:41 PMLinked URL: https://www.openwall.com/lists/oss-security/2026/07/22/14 | Posted by ilreb | 3 points | 0 comments
communitynews.ycombinator.comJul 22, 2026, 6:20 PMExecutive summary Qualys Threat Research Unit (TRU) identified CVE-2026-64600, a race condition in the Linux kernel’s XFS filesystem copy-on-write path. An attacker with an ordinary local account can exploit this race condition to overwrite protected files on disk and gain host root privileges on
vendorblog.qualys.comJul 22, 2026, 4:23 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.