Loading story…
A public proof-of-concept exploit has been released for CVE-2026-64600, a local privilege escalation flaw in the Linux kernel's XFS reflink handling known as RefluXFS. The exploit code uses the FICLONE ioctl to clone /etc/passwd into a writable file on the same XFS device, then races concurrent O_DIRECT writes across 32 threads to corrupt the original file and alter the root account entry, demonstrating a path from local access to elevated privileges on raw local XFS filesystems.
Follow-up discussion on the oss-sec mailing list said the PoC succeeds immediately on a local XFS system but has been difficult to reproduce when XFS is exported over NFS or placed beneath layered filesystems. Red Hat's Marco Benatto and XFS maintainer Darrick J. Wong said exploitation may still be possible if reflink semantics are preserved, but added RPC and filesystem-stack overhead appear to change or narrow the race window. Even where NFS reduces the likelihood of directly overwriting files such as /etc/passwd, the flaw could still let one user manipulate another user's files on affected systems.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Marco Benatto said he had not tested exploitation over NFS or layered filesystems but believed the exploit would likely remain valid if reflink semantics were preserved, though added overhead could make the race harder. Darrick J. Wong added that exploitation was still likely possible under direct-I/O conditions, but extra RPC work in NFS probably makes the race much harder to reproduce.
In oss-sec discussion, Dr. Thomas Orgis reported that the public proof-of-concept succeeded instantly on a local XFS system but ran unsuccessfully for several minutes when the XFS filesystem was exported over NFS. He said this appeared to reduce the impact from full system compromise to one user manipulating another user's files in his NFS scenario.
A public GitHub repository, CVE-2026-64600-Refluxfs-PoC, was uploaded by litosmartin with exploit code in refluxfs.c. The PoC targets local privilege escalation on XFS by cloning /etc/passwd and racing direct writes against reflinked data.
A Qualys Security Advisory about CVE-2026-64600 was posted to oss-security. Later references identify this July 22 advisory as the basis for subsequent discussion and the public proof-of-concept.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Qualys disclosed **CVE-2026-64600**, dubbed **RefluXFS**, a local privilege-escalation flaw in the Linux kernel's XFS filesystem that can let an unprivileged user gain full root access. The bug is a race condition in XFS reflink direct-I/O copy-on-write handling that allows protected root-owned files to be overwritten on disk, including `/etc/passwd` and SUID-root binaries, with changes persisting across reboots. Qualys said the flaw was introduced in Linux `4.11` and affects mainline and stable kernels where XFS is deployed with reflink enabled. The issue is considered broadly exposed because reflink has been the default for `mkfs.xfs` since 2019, and default installations of **RHEL-derived distributions**, **Oracle Linux**, **Amazon Linux**, and **Fedora Server** may be exploitable out of the box when using reflink-enabled XFS root filesystems. Qualys estimated more than **16.4 million systems** could be affected, published a working proof of concept and demonstration video, and said there are no reliable temporary mitigations beyond patching and rebooting. A fix was merged into the Linux kernel tree on July 16, 2026, and distributions are now backporting the patch.
Aug 25, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Researchers disclosed **Fragnesia** (`CVE-2026-46300`), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain **root** by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM **ESP-in-TCP** path, with additional exposure through `rxrpc` on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as `/usr/bin/su` to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility. Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through `esp4` and `esp6`, with AlmaLinux 9 and 10 also exposed through `rxrpc` when `kernel-modules-partner` is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the `esp4`, `esp6`, and `rxrpc` kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for **$170,000**.
Jun 29, 2026