Post #4062111

RefluXFS (CVE-2026-64600) is a race-condition in the Linux kernel's XFS copy-on-write path. (Kernel updates are available.) On an XFS filesystem with reflink enabled (Default on RHEL and similar, plus Amazon Linux), if you win a race during the copy-on-write remap lets the unprivileged local user overwrite the on-disk contents of any readable file on that volume including /etc/passwd or a SUID-root binary. What makes this wild: the changes persist across reboots, produce no kernel logs, bypass SELinux and Kernel Address Space Randomization (KASLR). PoCs reliably exploiting the vuln. Check if you are in scope: # xfs_info / | grep -i "reflink=1" #minimalist #Linux #Selfhosting #selfhosted #selfhost #InfoSec #Exploit