Over 16 million systems are vulnerable to a newly revealed Linux kernel bug that went unnoticed for nine years. Known as RefluXFS, this race condition affects the XFS filesystem’s reflink feature, allowing low-privilege users to gain root-level access without leaving a trace. The flaw was discovered in June 2026 when the Qualys Threat Research Unit collaborated with Anthropic’s AI Project Glasswing, deploying the Claude Mythos Preview model to pinpoint a Dirty COW-style exploit.

How the RefluXFS Bug Works and Why It Matters

The weakness lies in the xfs_reflink_allocate_cow() function, which mishandles reference counts after releasing an internal lock while waiting for transaction log space. This creates a race condition that attackers can exploit by executing simultaneous O_DIRECT writes on the same reflink-shared file. As a result, data intended for temporary copies ends up overwriting the original protected files at the block level.

Saeed Abbasi from Qualys explained that this flaw allows ordinary users to overwrite any readable file on an XFS volume quickly and stealthily. On a standard RHEL 10.2 system, an attacker could remove the root password from /etc/passwd within seconds, gaining unrestricted root access. The exploit leaves no kernel logs, preserves file ownership and permissions, and survives reboots. It sidesteps common security layers like SELinux Enforcing, KASLR, SMEP, SMAP, seccomp, container isolation, and kernel lockdown because it operates beneath these protections in the filesystem allocation layer.

Widespread Impact and Limited Fixes

Systems running XFS with reflink enabled by default which includes RHEL 8 through 10, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, Amazon Linux 2023+, and Fedora Server 31+ face significant risk. Over 16.4 million setups are potentially affected. There are no runtime workarounds or mount options to disable reflink on existing filesystems. The only remedy is applying a vendor-issued kernel update followed by a full reboot to patch the kernel.

This AI-led discovery highlights how machine learning models are beginning to accelerate vulnerability research, building on recent developments in cybersecurity driven by advanced algorithms.

This information is provided for awareness and does not constitute financial advice.