Executive summary
Qualys Threat Research Unit (TRU) identified CVE-2026-64600, a race condition in the Linux kernel’s XFS filesystem copy-on-write path. An attacker with an ordinary local account can exploit this race condition to overwrite protected files on disk and gain host root privileges on affected systems, including deployments running SELinux in Enforcing mode.
This discovery emerged from a structured research initiative between Qualys and Anthropic, where we integrated Claude Mythos Preview into our manual audit workflow to accelerate our research while maintaining strict human oversight.
Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer. This primitive converts directly into host root privileges. Exploitation is highly reliable and leaves no kernel log output. The vulnerability affects any Linux distribution that ships an XFS root filesystem with reflink enabled. This includes default installations of major enterprise platforms such as RHEL, Oracle Linux, Amazon Linux, and Fedora.
This vulnerability has been present since kernel version 4.11 (circa 2017) and, based on analysis with Qualys CyberSecurity Asset Management, potentially impacts over 16.4 million systems worldwide, requiring immediate attention due to its high exploitability and lack of kernel logging.
Immediate kernel patching is recommended to neutralize this vulnerability. Exploitation succeeds consistently under standard hardening settings, and the on-disk modification survives a system reboot.
Vendor-fixed kernels are now available and being backported to enterprise distributions. Organizations should prioritize patching exposed and multi-tenant systems and ensure a reboot to verify the update. As of now, there are no reliable or practical mitigations or temporary configuration changes available.
We rate this as an emergency priority because exploitation could begin from ordinary local privileges. The vulnerability is present in standard enterprise kernel builds, and a successful exploitation provides host root. The exploitation works under common kernel hardening settings, and fixed kernels are available.
RefluXFS is less about what AI can do than how it’s used responsibly. Capable models have been broadly available for some time; direction, not capability, was the constraint. The lesson isn’t that AI can be aimed at software to produce exploits; it’s that AI, paired with expert judgment, helps defenders find and close serious flaws before they’re abused.
Discovery process and research methodology
For this research, we tasked Claude Mythos Preview with hunting for a Dirty COW–style race condition in the Linux kernel, iteratively refining our prompts to narrow its focus toward race conditions in the core memory-management and filesystem directories. After several iterations, the model identified a race condition in the XFS filesystem and generated a functional proof-of-concept local privilege escalation. Our security researchers then took over: we reviewed the model’s reasoning, reproduced the exploit, and independently verified every technical claim before coordinating disclosure with upstream maintainers. The model also produced an initial draft of the advisory, which our team validated and corrected against our own testing. This human-validated, AI-accelerated approach let us surface a complex kernel race condition while holding to the strict accuracy and responsible-disclosure standards expected; every finding here cleared the same