RefluXFS

Single-file C local privilege-escalation exploit targeting CVE-2026-64600, described as a RefluXFS Linux kernel/filesystem flaw. The repository contains one source file, exploit.c, which is the clear entry point and complete exploit implementation. The code is not part of a larger framework. Exploit flow: it first checks readability of /etc/passwd, opens it, and creates a backup at /tmp/passwd.orig.bak. It reads the first block of /etc/passwd, searches for the string 'root:x:0', and modifies it in memory to 'root::0' by removing the password marker. It then creates /var/tmp/passwd, sizes it to match the target, and issues ioctl(FICLONE) to create a reflink clone of /etc/passwd. After that, it launches 8 background threads that continuously write, fdatasync, truncate, and sync scratch files under /var/tmp/reflux_scratch to create allocation and transaction pressure. In parallel, it launches 32 racing threads that open the reflink file with O_WRONLY|O_DIRECT and concurrently pwrite the crafted block-sized buffer. The intended capability is to exploit a copy-on-write/reflink race or corruption condition so writes to the clone affect the original /etc/passwd backing data. Success is verified by reopening /etc/passwd and checking whether the beginning now contains 'root::0'. If successful, the exploit reports that the root password has been removed and that root login without a password is possible. Notable technical characteristics: use of pthread barriers for synchronized racing, O_DIRECT block-aligned writes, FICLONE reflink cloning, repeated retry loop with short sleeps, and minimal cleanup. There are no network endpoints; all observables are local filesystem paths. Overall, this is an operational local kernel/filesystem privilege-escalation exploit that directly modifies an authentication file rather than spawning a shell or downloading a secondary payload.

This repository contains a single standalone C local privilege-escalation exploit, refluxfs.c. It is not part of a larger framework. The code targets a vulnerable XFS reflink/copy-on-write behavior by cloning /etc/passwd into /var/tmp/passwd.sync with the FICLONE ioctl, then opening many O_DIRECT write handles to the clone and launching 64 threads that simultaneously pwrite() a crafted 4KB buffer at offset 0. The crafted buffer is derived from the original /etc/passwd contents but intentionally shifts bytes in the root account entry, aiming to transform the beginning of the file so the root password field is corrupted/removed. The exploit repeatedly performs this cycle until an O_DIRECT read of /etc/passwd no longer begins with "root:x:0", which it interprets as successful corruption. It includes environmental checks to ensure source and destination are on the same device and that the filesystem magic matches XFS. There are no network capabilities, C2 endpoints, or remote targets; the exploit is purely local and file-system focused. Its purpose is to obtain root access by modifying authentication data on disk so the attacker can run su and escalate privileges.

This repository is a small standalone local privilege escalation PoC for CVE-2026-64600, targeting a race condition in XFS reflink/Copy-On-Write behavior. It contains two files: a README describing the vulnerability, prerequisites, affected distributions, mitigation ideas, and usage notes; and a single C source file, refluxfs.c, which implements the exploit. The exploit is not network-facing and does not contact remote infrastructure. Its attack surface is purely local: it abuses the FICLONE ioctl on XFS to create a reflink clone of /etc/passwd into a writable file on the same filesystem, then uses concurrent O_DIRECT pwrite operations from 32 threads against the clone file to trigger the race. The crafted overwrite buffer is derived from the original first 4KB of /etc/passwd, but with the root account line altered from 'root:x:...' to 'root::...'. The code loops until a post-write check shows the beginning of /etc/passwd no longer matches 'root:x:0', indicating the overwrite succeeded. Key exploit logic in refluxfs.c: - main(): validates that /etc/passwd and the clone path are on the same device, verifies the filesystem is XFS via statfs magic 0x58465342, checks FICLONE support, reads the first 4KB of /etc/passwd, modifies the root entry in-memory, and starts the exploitation loop. - setup(): opens /etc/passwd and the clone file, performs FICLONE, launches the racing threads, then reopens /etc/passwd to test whether the overwrite succeeded. - launch_threads(): initializes a pthread barrier and spawns 32 worker threads. - thread_code(): each thread waits on the barrier, opens the clone file with O_WRONLY|O_DIRECT, and pwrites the malicious buffer at offset 0. The main fingerprintable local endpoints are /etc/passwd and the hardcoded clone path /home/user/passwd.sync. The README notes this path may need to be changed to another writable location on the same partition, such as /var/tmp. The exploit provides a concrete privilege-escalation outcome rather than mere detection, but the payload is hardcoded and narrow in scope, making it best classified as OPERATIONAL rather than weaponized.

Repository contains two files: a Bash detection helper (Detection.sh) and a C local privilege escalation PoC (exploit.c). The main exploit is a standalone C program targeting CVE-2026-64600, described as a race condition in the Linux kernel XFS copy-on-write/reflink path. Its purpose is to win a race during reflinked O_DIRECT writes so that data intended for a scratch clone file is written into the shared backing blocks of /etc/passwd. Exploit structure: build_payload() reads /etc/passwd into memory, locates the root account entry, and removes the 'x:' sequence so the line becomes 'root::', effectively clearing the root password requirement. The crafted payload is also saved to /tmp/.reflux_payload. do_race_round() creates a scratch file under /var/tmp, reflinks /etc/passwd into it using the FICLONE ioctl, prepares an aligned O_DIRECT buffer, and launches multiple racing writer threads synchronized with a pthread barrier. Additional widener_thread() workers continuously create and sync temporary files in /var/tmp to increase filesystem activity and widen the race window. The main loop repeats many rounds and periodically checks whether exploitation succeeded. Capabilities: local kernel/filesystem race exploitation, reflink abuse via FICLONE, repeated concurrent direct writes, filesystem churn to improve timing, and post-exploitation validation by checking whether the root password field was cleared. If successful, the exploit provides practical privilege escalation by enabling 'su' to root without a password. Detection.sh is not the exploit itself; it is a companion assessment script. It checks kernel version ranges, enumerates XFS mounts with reflink enabled using xfs_info/findmnt, and verifies whether /etc/passwd and a writable directory (/var/tmp) are on the same vulnerable volume. This script is a detection/prerequisite checker, while exploit.c is the actual exploit implementation.