Data Fork Mapping Issue in Linux Kernel by Linux Foundation
CVE-2026-64600

7.8HIGH

Key Information:

Vendor

Linux
Status
Linux
Vendor
CVE Published:
23 July 2026

Badges

📈 Score: 1,590👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-64600?

CVE-2026-64600 is a vulnerability found in the Linux kernel, specifically linked to the XFS file system. This issue arises from a data fork mapping problem which occurs during the management of inode operations. The vulnerability manifests when two helper functions, tasked with managing data and copy-on-write (cow) mappings, cycle the inode lock (ILOCK) without refreshing the data fork mapping. As a consequence, the mappings utilized during operations may become outdated, leading to incorrect functionality when direct I/O write operations proceed with stale data fork mappings. This vulnerability can negatively impact organizations by potentially resulting in data integrity issues and unintentional data corruption during file system operations, especially in environments that rely heavily on the integrity of file data.

Potential impact of CVE-2026-64600

  1. Data Corruption: The primary risk associated with this vulnerability is the potential for data corruption due to stale data fork mappings. This could lead to critical data being written incorrectly, jeopardizing the accuracy and reliability of stored information.

  2. File System Reliability: Organizations may experience issues with the reliability of the XFS file system. Operations that depend on accurate data mappings could fail or produce incorrect results, complicating data management and retrieval tasks.

  3. Operational Downtime: The vulnerability could lead to an increased risk of operational downtime as systems may need to be taken offline for integrity checks and repairs, impacting overall productivity and potentially leading to financial losses.

Affected Version(s)

Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5

Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5

Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 < 50f0012da1040f69a4e788cd9aed587c9a04983f

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-64600
Created by 0xBlackash

CVE-2026-64600-RefluXFS
Created by masrikky

News Articles

favicon imageTechtimes

Linux Kernel Flaw Exposes 16 Million RHEL Systems to Silent Root Takeover

Linux kernel vulnerability CVE-2026-64600 exposes an estimated 16.4 million RHEL and enterprise Linux systems to silent root takeover via a nine-year-old XFS filesystem race condition. SELinux,

1 month ago

favicon imageBleepingComputer

New RefluXFS Linux flaw lets attackers gain root privileges

A nine-year-old race condition vulnerability in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.

1 month ago

favicon imageThe Hacker News

Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

CVE-2026-64600 lets local users overwrite root-owned files on reflink-enabled XFS systems, preserving metadata and persistent root access after reboot

1 month ago

References

https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b0...
https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0...
https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • 📰

    First article discovered by Cybersecuritynews

  • Vulnerability Reserved

.