Affected Systems
Linux kernel v4.11 and later (since February 2017) with XFS filesystem and reflink enabled (default on RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, CloudLinux). Qualys estimates 16.4 million systems potentially affected. Requires local unprivileged user access and writable directory.
Exploitation Status
Proof-of-concept available. Qualys TRU developed functional exploit demonstrating reliable privilege escalation. No reports of active in-the-wild exploitation at time of disclosure. Exploitation is highly reliable, leaves no kernel logs, and survives reboot.
Business Impact
Local attackers can overwrite root-owned files (e.g., /etc/passwd) or SUID-root binaries (e.g., /usr/bin/su) to gain root privileges. Standard defenses (SELinux, kernel lockdown, container isolation, KASLR, SMEP, SMAP) do not block this attack because it operates at the filesystem allocation layer. On-disk modifications persist across reboots with no audit trail. Critical for multi-tenant and exposed Linux systems. Patch available since July 16, 2026 (commit 2f4acd0).
Urgency
🔴 Immediate
Recommended Actions
- Apply vendor-provided kernel patches immediately for all Linux systems running kernel v4.11 or later with XFS filesystem
- Reboot all patched systems to activate the updated kernel (patch does not take effect until reboot)
- Prioritize patching for multi-tenant environments, shared hosting, and systems with local user access
- Verify kernel version post-reboot to confirm patch deployment (check for commit 2f4acd0 or vendor-specific patch)
- Review /etc/passwd and SUID-root binaries for unauthorized modifications on systems with local untrusted users prior to patching