Loading vulnerability…
RefluXFS is a local privilege-escalation vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600. The flaw is a race condition in the reflink copy-on-write direct-I/O path affecting kernels since Linux 4.11. During handling of concurrent O_DIRECT writes to the same reflinked file, XFS can briefly drop and later reacquire the inode lock while waiting for log space, but then continue using a stale physical block mapping. If a second writer completes a copy-on-write remap during that window, the first writer may incorrectly perform an in-place write to the original shared block instead of a newly allocated private block. As a result, an unprivileged local user can overwrite the on-disk contents of any readable file located on an affected reflink-enabled XFS filesystem. Reported exploitation involves cloning a readable protected file into an attacker-controlled file on the same filesystem and racing direct-I/O writes so that the corruption lands on the original file's blocks. Because the write occurs through direct I/O at the filesystem allocation layer, the modification is persisted to disk, can survive reboot, and may not alter the target inode metadata.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A local privilege escalation vulnerability in the Linux kernel XFS filesystem reflink copy-on-write path caused by a race condition between concurrent O_DIRECT writes, allowing an unprivileged local user to overwrite protected files and gain root privileges.
A Linux kernel XFS local privilege escalation vulnerability caused by a race condition in the XFS copy-on-write path, allowing an unprivileged local user to overwrite protected files and gain root privileges.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.