Last Updated: 2026-07-27T13:38:59Z
CVSS: 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
A bug in the COW handler of XFS on a filsystem means an unprivileged user can abuse this to write on any file they can read on the same partition as the target. XFS is enabled by default on RHEL since RHEL 7. Other distros using it are affected too.
Create copy of the original, write on the clone and the underlying file. If the file is a root owned config file or SUID binary, well, there’s your LPE.
Mitigation exists using System Tap on RHEL systems, see [2].
Long term, having RO / partitions is going to help you, if you can afford it.
References
oss-security - Re: RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) (Mitigation)
PoC:
CVE-2026-64600/README.md at main · Debajyoti0-0/CVE-2026-64600 · GitHub (AI - Has a lot of bloat)