Linux XFS reflink flaw could grant root via race condition

Qualys warns of RefluXFS, a nine-year-old race-condition in the XFS reflink feature (CVE-2026-64600) that enables local unprivileged users to overwrite blocks backing protected files and gain root on Linux kernels 4.11+. The attack clones a target file to a scratch file and races concurrent writes in the copy-on-write path, causing disk-block modifications that survive reboot and produce no kernel logs. Affected distros include RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux, potentially impacting millions. Kernel patches are available and backported; reboot to verify. There are currently no reliable mitigations beyond patching.