This 9-Year-Old Linux Flaw Grants Root Access on Default RHEL Installs

Robert Moore · 2026-07-23

A newly disclosed Linux kernel vulnerability, dubbed RefluXFS and tracked as CVE-2026-64600, is turning heads in the cybersecurity world. It lets an unprivileged local user overwrite root-owned files on an XFS filesystem, potentially granting persistent root access. The flaw was revealed on July 22 by Qualys, a leading security research firm, which noted that default installations of Red Hat Enterprise Linux, its derivatives, Fedora Server, and Amazon Linux are prime targets for exploitation. ### What Makes RefluXFS Dangerous? This isn't just another kernel bug. It's a race condition that has been lurking in the code for nearly a decade. The vulnerability allows a local user without special permissions to overwrite files owned by the root user, which is the highest level of access on a Linux system. Once exploited, an attacker can gain persistent root privileges, meaning they can control the system entirely and maintain that control even after reboots. Qualys demonstrated the race condition in a proof-of-concept exploit, showing how an attacker can manipulate the XFS filesystem to overwrite critical system files. The company emphasized that default installations of RHEL and its derivatives are particularly vulnerable because they often come with XFS as the default filesystem. ### Who Is at Risk? - Red Hat Enterprise Linux (RHEL) - Fedora Server - Amazon Linux - Any distribution using XFS as the default filesystem If you're running one of these systems out of the box, your machine could be vulnerable. The flaw is especially concerning for cloud environments where Amazon Linux is widely used. ### How to Protect Your Systems Patches are already rolling out from major vendors. Red Hat has released updates for RHEL 8 and 9, while Amazon has patched Amazon Linux 2 and 2023. Fedora users should update to the latest kernel version immediately. Here's what you can do right now: - Apply kernel updates as soon as they are available - Restrict local user access to trusted individuals only - Monitor system logs for unusual file overwrite attempts - Consider using a different filesystem if XFS isn't critical ### The Bigger Picture This flaw highlights a recurring issue in enterprise Linux environments: legacy code can harbor critical vulnerabilities for years. The RefluXFS bug was introduced in kernel version 3.16, released in 2014, and has been present in every version since. It took nine years for someone to discover it. For security teams, this is a reminder to regularly audit kernel configurations and stay on top of patch management. Even default installations, which are often considered safe, can be compromised. ### Final Thoughts While the RefluXFS vulnerability is serious, it's also a manageable risk. With prompt patching and good security hygiene, most organizations can mitigate the threat. But if you're running a default RHEL install and haven't updated recently, now is the time to act. Stay vigilant, keep your systems patched, and remember that even the oldest code can hide the newest dangers.