A severe and long-dormant vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600 and dubbed "RefluXFS," has been publicly disclosed, presenting a major risk to default installations of major enterprise distributions. Security researchers at Qualys demonstrated the flaw allows a local, unprivileged user to gain persistent root access on systems running Red Hat Enterprise Linux (RHEL), Fedora Server, and Amazon Linux.
The vulnerability, which has lain undetected in stable kernel code for nearly a decade, leverages a race condition within the XFS filesystem. Exploitation enables an attacker to overwrite files owned by root, a capability that can be escalated to establish administrative access that survives system reboots. This persistence significantly increases the threat level over typical exploits that grant only temporary elevation.
The severity is amplified by the flaw's default exposure. A standard, out-of-the-box installation of the affected distributions creates the necessary conditions for exploitation, requiring no special configuration to be vulnerable. With Qualys publishing a working proof-of-concept, the theoretical risk has transformed into an immediate operational concern.
Organizations are urged to apply kernel security updates from their distribution vendors as the primary and definitive remediation. For systems where immediate patching is not operationally feasible, a temporary mitigation exists: disabling the user.max_user_namespaces system parameter. However, administrators must conduct thorough, environment-specific testing before implementing this workaround, as it may disrupt container runtimes and other applications that rely on user namespaces.
This disclosure underscores a persistent challenge within the open-source ecosystem: critical flaws can remain dormant in foundational, "mature" components for years. The RefluXFS incident highlights the need for continuous security scrutiny of core kernel subsystems, even those considered stable, to mitigate risks in widely deployed software. The publication of a functional exploit makes patching operations a high priority for any enterprise running the affected distributions.
Linux 核心 XFS 檔案系統中一個嚴重且長期潛伏的安全漏洞已被公開披露，編號為 CVE-2026-64600，並被命名為「RefluXFS」。該漏洞對各大企業級 Linux 發行版的預設安裝構成重大風險。安全研究公司 Qualys 的研究人員證實，該漏洞允許本機非特權用戶在運行 Red Hat Enterprise Linux (RHEL)、Fedora Server 及 Amazon Linux 的系統上取得持久化最高權限。
這款在穩定核心代碼中潛伏近十年的漏洞，利用了 XFS 檔案系統中的一個競態條件。成功利用此漏洞可讓攻擊者覆寫由 root 擁有的檔案，此能力可進一步升級為建立在系統重啟後仍然有效的管理員存取權限。這種持久性相較於僅能提供臨時權限提升的典型漏洞利用方式，顯著提升了威脅等級。
此漏洞的嚴重性因預設曝露而加劇。受影響發行版的標準、出廠即用安裝會創造出漏洞利用所需的必要條件，無需特殊配置即存在風險。隨著 Qualys 發佈了可行的概念驗證程式碼，理論上的風險已轉變為即時的營運隱憂。
相關機構應儘速套用來自其發行版供應商的核心資安更新，作為首要且明確的補救措施。對於在營運上無法立即修補的系統，存在一種臨時緩解方案：停用 user.max_user_namespaces 系統參數。然而，管理員在實施此應變措施前，必須進行徹底且符合環境特性的測試，因其可能干擾依賴使用者命名空間的容器運行環境及其他應用程式。
此次披露突顯了開源生態系統中一項長期存在的挑戰：關鍵漏洞可能在被視為「成熟」的基礎組件中潛伏多年。RefluXFS 事件凸顯了對核心內核子系統持續進行安全審查的必要性，即便是那些被認為穩定的組件，亦需持續關注以緩解廣泛部署軟件的風險。由於功能性漏洞利用程式碼已被公開，對於任何運行受影響發行版的企業而言，套用修補程式已成為高優先級事項。