importantSYS.SOURCE: The Hacker News• 2026-07-23T13:34:35+05:30

Nine-Year-Old XFS Reflink Vulnerability Allows Local Privilege Escalation in RHEL

#vulnerability #linux #rhel #ai #security

A nine-year-old vulnerability in the XFS filesystem's reflink feature allows local users to escalate privileges to root on default Red Hat Enterprise Linux (RHEL) installations. The flaw, tracked as CVE-2026-64600, was disclosed on July 22, 2026, and patches are now available for affected systems.

RefluXFS, a new Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access.

Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and Amazon Linux can meet the conditions for exploitation.

The company demonstrated the race

Read original article

*** END OF TRANSMISSION ***

> THE AI ECONOMY: INSIGHTS FROM THE FIRST ATLAS REPORT > SYNTHETIC IDENTITY FRAUD TARGETING MACHINE IDENTITIES IN ENTERPRISE ENVIRONMENTS > EXPLOITATION OF GITHUB ACTIONS RUNNERS FOR CPANEL/WHM SERVER ATTACKS VIA COMPROMISED REPOSITORIES > AMD RYZEN AI MAX+ PRO 495 DESKTOP WITH 192GB MEMORY LAUNCHES FROM FRAMEWORK > CORPORATE GREED AND PRODUCT QUALITY DEGRADATION: A BRAND ANALYSIS > KIMI K3'S ADVANCED CAPABILITIES ATTRIBUTED TO INTERNAL DEVELOPMENT, NOT ANTHROPIC'S FABLE DISTILLATION > EU IMPOSES €890M FINE ON GOOGLE FOR ANTI-COMPETITIVE PRACTICES IN SEARCH AND APP STORES > GOOGLE INTRODUCES SELFIE VIDEO AUTHENTICATION FOR ACCOUNT RECOVERY > NINE-YEAR-OLD XFS REFLINK VULNERABILITY ALLOWS LOCAL PRIVILEGE ESCALATION IN RHEL > CHECK POINT ADDRESSES CRITICAL SMARTCONSOLE AUTHENTICATION BYPASS VULNERABILITY CVE-2026-16232> THE AI ECONOMY: INSIGHTS FROM THE FIRST ATLAS REPORT > SYNTHETIC IDENTITY FRAUD TARGETING MACHINE IDENTITIES IN ENTERPRISE ENVIRONMENTS > EXPLOITATION OF GITHUB ACTIONS RUNNERS FOR CPANEL/WHM SERVER ATTACKS VIA COMPROMISED REPOSITORIES > AMD RYZEN AI MAX+ PRO 495 DESKTOP WITH 192GB MEMORY LAUNCHES FROM FRAMEWORK > CORPORATE GREED AND PRODUCT QUALITY DEGRADATION: A BRAND ANALYSIS > KIMI K3'S ADVANCED CAPABILITIES ATTRIBUTED TO INTERNAL DEVELOPMENT, NOT ANTHROPIC'S FABLE DISTILLATION > EU IMPOSES €890M FINE ON GOOGLE FOR ANTI-COMPETITIVE PRACTICES IN SEARCH AND APP STORES > GOOGLE INTRODUCES SELFIE VIDEO AUTHENTICATION FOR ACCOUNT RECOVERY > NINE-YEAR-OLD XFS REFLINK VULNERABILITY ALLOWS LOCAL PRIVILEGE ESCALATION IN RHEL > CHECK POINT ADDRESSES CRITICAL SMARTCONSOLE AUTHENTICATION BYPASS VULNERABILITY CVE-2026-16232