Affected Systems
Linux kernel v4.11 and later (February 2017 onwards) with XFS filesystem and reflink enabled (default on RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, CloudLinux). Estimated 16.4 million systems affected. Requires local unprivileged user access and writable directory.
Exploitation Status
Proof-of-concept available. Qualys TRU developed functional exploit during research. Exploitation is highly reliable, requires local access, and bypasses SELinux, kernel lockdown, container isolation, KASLR, SMEP, and SMAP. No public reports of active exploitation in the wild at time of disclosure.
Business Impact
Local attackers can overwrite root-owned files (e.g., /etc/passwd) or SUID-root binaries (e.g., /usr/bin/su) to gain root privileges. Exploitation leaves no kernel logs, modifications persist across reboots, and standard hardening mechanisms do not prevent the attack because it operates at the filesystem allocation layer. Multi-tenant and shared hosting environments face elevated risk. Patched July 16, 2026 via commit 2f4acd0; vendor kernels now available and being backported.
Urgency
🟠 Within 24 hours
Recommended Actions
- Apply vendor-supplied kernel patches immediately for RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux systems running XFS with reflink.
- Reboot all patched systems to load the updated kernel (kernel updates require reboot to take effect).
- Prioritize patching for multi-tenant systems, shared hosting environments, and any Linux servers with local user access.
- Audit systems for unexpected modifications to SUID-root binaries and critical configuration files (e.g., /etc/passwd, /etc/shadow, /usr/bin/su) using file integrity monitoring or package verification tools (rpm -Va, debsums).
- Monitor for unusual local privilege escalation attempts via EDR/host-based detection, focusing on O_DIRECT file operations and reflink usage patterns on XFS filesystems.