New Linux Kernel Vulnerability "RefluXFS" Grants Root Access via XFS Race Condition A critical Linux kernel vulnerability, CVE-2026-64600 (dubbed RefluXFS), has been disclosed by Qualys Threat Research Unit (TRU), allowing unprivileged local users to overwrite protected system files and escalate to root privileges even on systems with SELinux in Enforcing mode. The flaw stems from a race condition in the XFS filesystem’s copy-on-write (CoW) path, triggered when two concurrent O_DIRECT writes target the same reflinked file. ### How the Exploit Works XFS normally handles reflinked file writes by allocating new blocks, but the kernel briefly drops its inode lock while waiting for transaction log space. During this window, a second write operation can remap the file and drop the reference count, causing the first write to corrupt the original block using a stale reference. Since O_DIRECT bypasses the page cache, the malicious write persists on disk without leaving kernel logs, making detection nearly impossible. Qualys demonstrated a proof-of-concept on a default RHEL 10.2 deployment, silently removing the root account’s password protection in seconds, granting passwordless root access that survives reboots. ### Scope & Impact - Affected Systems: Linux kernels 4.11+ (since 2017), including RHEL 8/9/10, CentOS Stream, Oracle Linux, Rocky/AlmaLinux, Amazon Linux 2023, and Fedora 31+. - Lower-Risk Distros: Debian, Ubuntu, and SUSE are only vulnerable if XFS is manually configured with `reflink=1`. - Conditions for Exploitation: - Kernel 4.11+ without the patch. - XFS filesystem with `reflink=1` enabled. - A writable directory for an unprivileged user and a high-value target (e.g., SUID-root binary). - Estimated Impact: Over 16.4 million systems worldwide, per Qualys’ analysis. ### Security Bypass & No Workarounds The flaw operates below conventional kernel hardening mechanisms, evading protections like: - KASLR, SMEP, SMAP (memory protections). - Kernel lockdown (no restriction on O_DIRECT/FICLONE). - SELinux (does not block the vulnerable code path). - Container isolation (user-namespace restrictions and capability limits fail to mitigate). No reliable workaround exists patching is the only solution. ### AI-Assisted Discovery & Broader Trend The vulnerability was identified through a joint research initiative between Qualys and Anthropic, using Claude Mythos Preview to hunt for Dirty COW-style race conditions. After iterative prompting, the AI model pinpointed the XFS flaw and generated a working PoC, later verified by Qualys engineers. This follows a 2026 trend of high-impact Linux privilege-escalation bugs, including: - CVE-2026-46333 (nine-year-old ptrace flaw). - CrackArmor (AppArmor-based root-access chain, affecting 12M+ systems). - DirtyClone, DirtyFrag, and Copy Fail (page-cache corruption bugs). ### Vendor Response & Patching Fixed kernels are already available for RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora, with backports in progress. Organizations are advised to apply updates and reboot affected systems, particularly internet-facing and multi-tenant environments, as no interim mitigation exists.

Dirty Frag: New Linux Kernel LPE Vulnerability Grants Root Access Across Major Distros A newly disclosed Linux kernel vulnerability, dubbed Dirty Frag, enables local privilege escalation (LPE) by chaining two page-cache write flaws xfrm-ESP Page-Cache Write and RxRPC Page-Cache Write to achieve root access on nearly all major Linux distributions. The exploit, publicly released on May 7, 2026, following an embargo break, leverages a deterministic logic flaw rather than race conditions, ensuring a high success rate without kernel panics. Discovered by security researcher Hyunwoo Kim (@v4bel), Dirty Frag exploits the kernel’s zero-copy send path, where `splice()` inserts a reference to a read-only page cache (e.g., `/etc/passwd` or `/usr/bin/su`) into the `frag` slot of a sender-side `sk_buff`. Receiver-side cryptographic operations then modify the page cache in-place, corrupting files even for unprivileged users. ### Exploit Mechanics 1. xfrm-ESP Variant: - Targets `esp_input()` in the IPsec ESP receive path, skipping buffer allocation checks (`skb_cow_data()`) for non-linear `skb`s. - Attackers use `XFRMA_REPLAY_ESN_VAL` to overwrite arbitrary bytes (e.g., `/usr/bin/su`) with a root-shell ELF, requiring user namespace creation (`unshare(CLONE_NEWUSER)`), which is blocked on some Ubuntu systems via AppArmor. 2. RxRPC Variant: - Exploits `rxkad_verify_packet_1()` to perform in-place decryption on the first 8 bytes of an RxRPC payload. - Attackers brute-force a session key to manipulate plaintext (e.g., emptying `/etc/passwd`’s password field), bypassing PAM authentication. This variant does not require namespace privileges but relies on the `rxrpc.ko` module, absent by default on RHEL but present on Ubuntu. Chaining both exploits ensures root access across distributions, with the PoC first attempting the ESP path before falling back to RxRPC if `unshare` fails. ### Affected Systems The vulnerabilities span nine years, with the ESP flaw introduced in January 2017 (commit `cac2661c53f3`) and the RxRPC flaw in June 2023 (commit `2dc334f1a63a`). Confirmed affected distributions include: - Ubuntu 24.04.4 (kernel 6.17.0-23) - RHEL 10.1 (kernel 6.12.0-124.49.1) - openSUSE Tumbleweed (kernel 7.0.2-1) - CentOS Stream 10, AlmaLinux 10, Fedora 44 ### Patches & Mitigation - The ESP patch, using `SKBFL_SHARED_FRAG` to enforce buffer isolation, was merged into the netdev tree on May 7, 2026. - The RxRPC patch remains unmerged upstream. - No CVEs have been assigned due to the premature embargo break. - Temporary mitigation involves blacklisting the affected modules (`esp4`, `esp6`, `rxrpc`) via: ```bash sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" ``` This disrupts IPsec and RxRPC functionality, requiring careful evaluation for systems reliant on VPNs. The full technical write-up and PoC are available on the researcher’s GitHub repository.

Critical Linux Kernel Vulnerability (CVE-2026-23111) Enables Local Privilege Escalation A use-after-free vulnerability in the Linux kernel’s nftables subsystem has been disclosed, allowing unprivileged local attackers to escalate privileges to root on widely used distributions, including Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Tracked as CVE-2026-23111, the flaw was discovered in early 2025 and patched upstream on February 5, 2026, via a kernel commit. The bug resides in the nft_map_catchall_activate() function within nftables, a packet filtering framework built on Linux’s Netfilter hooks. Testing in a controlled lab environment revealed that Rocky Linux exhibited lower vulnerability exposure post-update compared to Ubuntu and Red Hat systems. However, kernel backports and system configurations influence risk, meaning version numbers alone may not fully indicate exposure. The vulnerability appears to affect Linux kernels 5.15 and later, while default kernels in AlmaLinux and Rocky Linux (5.14) remain unaffected. The flaw underscores the ongoing risks of privilege escalation in Linux environments, particularly in systems relying on nftables for network filtering.

New Linux Kernel Vulnerability (CVE-2026-64531) Enables Local Privilege Escalation via OVSwrap Flaw A critical Linux kernel vulnerability, tracked as CVE-2026-64531 and dubbed OVSwrap, has been disclosed, allowing unprivileged local users to escalate privileges to root on a wide range of Linux distributions. The flaw resides in the Open vSwitch (OVS) kernel datapath, a networking component commonly used in cloud, container, and virtualization environments. The vulnerability was discovered by researcher Asim Viladi Oglu Manizada using an experimental approach combining large language models with structured memory-geometry visualizations to analyze complex kernel memory bugs. The issue stems from a 16-bit length field limitation in Netlink attributes, which OVS uses to store network actions. While the kernel permits action streams exceeding 64 KiB, it failed to validate whether individual nested actions such as a CLONE wrapping multiple small conntrack actions remained under the 16-bit ceiling. When an attacker crafts an action large enough to exceed 65,535 bytes, the stored length value wraps around to a small number. The kernel then misinterprets attacker-controlled data as legitimate actions, enabling exploitation without memory grooming. The attack is highly reliable, resembling a logic bug rather than a traditional memory-corruption flaw. Exploitation requires no pre-existing OVS bridge, daemon, or administrative rights an unprivileged local user can trigger the vulnerability by creating a user and network namespace (e.g., via `unshare -Urn`), gaining CAP_NET_ADMIN, and initializing a private OVS datapath. Since most distributions ship OVS as a loadable kernel module that auto-loads on demand, the attack surface exists even on systems where OVS was never explicitly installed. The flaw affects default configurations across major Linux distributions, including AlmaLinux, Debian, Fedora, Ubuntu, Rocky Linux, Arch Linux, openSUSE Tumbleweed, Amazon Linux, Kali Linux, NixOS, and Linux Mint. Some systems require minor configuration adjustments, while older kernel branches (pre-2025) remain unaffected. The vulnerable code existed for 13 years but only became exploitable after a size limit was removed in 2025. Patches have been released in stable kernel versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Temporary mitigations include blacklisting the openvswitch module, disabling unprivileged user namespaces, or deploying an emergency BPF-based mitigation released alongside the proof-of-concept.