Nine-Year-Old Linux Kernel Flaw Grants Root on Default RHEL Installs — Patch Now

Nine-Year-Old Linux Kernel Flaw Grants Root on Default RHEL Installs

A local privilege escalation vulnerability in the Linux XFS filesystem driver — tracked as CVE-2026-64600 and dubbed RefluXFS — was publicly disclosed on July 22. The flaw has existed in the kernel for nine years and allows any unprivileged local user to overwrite root-owned files on an XFS filesystem, achieving persistent root access with no prior privileges required.

What Happened

Security researchers at Qualys identified and disclosed a critical flaw in the Linux kernel's XFS filesystem implementation. The vulnerability is not edge-case or configuration-dependent: default installations of Red Hat Enterprise Linux (RHEL) and its derivatives — including CentOS Stream, AlmaLinux, Rocky Linux, and Oracle Linux — are affected out of the box. Because XFS is the default filesystem for RHEL-family distributions, the attack surface is exceptionally broad across enterprise environments.

The nine-year lifespan of this bug means it is present across a wide range of kernel versions. Qualys has a strong track record of weaponizing local privilege escalation flaws quickly after disclosure (see their prior work on PwnKit and Looney Tunables), which means exploit code reaching the public is a near-certainty in the short term.

Why It Matters

Local privilege escalation vulnerabilities are routinely dismissed as "low risk" because they require existing access. That framing is wrong in practice. Any compromised service account, container escape, or low-privileged web shell gives an attacker a foothold — and a reliable LPE converts that foothold into full root immediately. On shared systems, cloud VMs, or any environment where multiple users or services run under separate accounts, this is effectively a full system compromise primitive.

RHEL and its derivatives dominate enterprise Linux deployments. If your production infrastructure runs on any RHEL-family OS with XFS (the default), assume you are vulnerable until patched.

What to Do

1. Patch immediately. Red Hat has been coordinating with Qualys and should have kernel updates available via yum update kernel or dnf update kernel. Apply and reboot. Verify the CVE is addressed in the release notes for your kernel version.

1. Audit your exposure. Run df -T | grep xfs to identify XFS-mounted filesystems on every host. Any system with XFS and local or service account access is at risk.

1. Apply kernel live-patching if reboots are constrained. RHEL Kernel Live Patching (kpatch) and third-party services like KernelCare can apply the fix without a reboot window — confirm CVE-2026-64600 coverage with your vendor.

1. Restrict local access aggressively. While patching proceeds, audit which users and service accounts have shell access. Remove unnecessary interactive access. Review /etc/passwd and sudo rules.

1. Monitor for exploitation. Watch for unexpected privilege escalations in auditd logs and SIEM alerts. Qualys's disclosure will accelerate public PoC development — treat the next 48–72 hours as high-alert.