RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600) 

Qualys TRU discloses RefluXFS (CVE-2026-64600), a reliable local privilege-escalation race condition in the XFS reflink copy-on-write path that lets an unprivileged user overwrite any readable file on reflink-enabled XFS volumes and achieve host root; the issue affects kernels since v4.11 on reflink-enabled XFS filesystems across many enterprise distributions, persists across reboot, leaves no kernel logs, and is mitigated only by applying vendor patches and rebooting.