Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs
A decade-old race condition in the Linux XFS file system allows local users to gain full root access on default RHEL installations.
Velocity
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The brief
A local privilege escalation flaw, identified as RefluXFS (CVE-2026-64600), has been discovered in the Linux kernel's XFS file system. The vulnerability stems from a race condition that has existed for nine years, enabling local users to achieve root access.
Coverage from Tech Times indicates that 16 million RHEL systems are exposed to this silent root takeover. Other reporting from Qualys, The Hacker News, Network World, and SecurityBrief Australia emphasizes the flaw's impact on default Red Hat Enterprise Linux installs.
Attention now centers on the implications of CVE-2026-64600 and the scale of affected systems across RHEL environments.
Synthesized by Archynetys from the headlines below under a strict no-invention contract. ✓ fact-checked: all claims supported by sources Updated 41m ago.
Quick answers
What is the specific vulnerability identifier?
The flaw is identified as CVE-2026-64600, also referred to as RefluXFS.
Which systems are specifically mentioned as being at risk?
Default RHEL installations are affected, with Tech Times reporting 16 million systems are exposed.
How does the vulnerability operate?
It is a race condition within the Linux XFS file system that allows local users to gain root access.
Coverage (5)
- Linux kernel flaw lets local users gain root access SecurityBrief Australia · 15h ago
- Linux Kernel Flaw Exposes 16 Million RHEL Systems to Silent Root Takeover Tech Times · 15h ago
- Linux XFS has a decade-old race condition allowing full root access Network World · 15h ago
- RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) Qualys · 15h ago
- Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs The Hacker News · 15h ago
Topics
Related trends
Firefox 153 Available With Support For Vulkan Video Decoding, Experimental JPEG-XL
Firefox 153 introduces a wide range of technical upgrades, from Vulkan video decoding to native containers and PDF merging.
Ubuntu 26.04 LTS vs. Windows 11 vs. CachyOS Performance On A $5399 Laptop
5 news sources are covering this Technology story right now — Archynetys is tracking how fast it spreads.
Linus Torvalds to critics of AI coding in Linux: "Fork it. Or just walk away."
Linus Torvalds addresses internal resistance to AI-assisted coding within the Linux kernel development process, challenging critics to fork the project.
Linus Torvalds tells AI haters to fork off
Linux creator Linus Torvalds has addressed internal resistance to AI integration within the kernel development process.
Microsoft’s Secure Boot has been broken for a decade and no one noticed until now
A long-standing vulnerability in Microsoft-signed UEFI shims has left Secure Boot susceptible to bypasses for a decade.
New Januscape Linux flaw allows VM escape on Intel, AMD devices
A critical 16-year-old flaw named Januscape allows guest virtual machines to escape to host systems on Intel and AMD devices.