Affected Systems

Linux kernel 4.11+ (2017–July 2026) on systems with XFS filesystems created with reflink=1. Default installations of RHEL/CentOS Stream/Oracle/Rocky/AlmaLinux/CloudLinux 8/9/10, Fedora Server 31+, Amazon Linux 2023, and Amazon Linux 2 (Dec 2022+) are vulnerable. Debian, Ubuntu, SLES, openSUSE affected only if XFS with reflink was manually chosen. RHEL 7 not affected.

Exploitation Status

Working proof-of-concept published by Qualys. Exploit demonstrated on default RHEL 10.2 and Fedora Server 44 installations, typically succeeding in under 10 seconds. No evidence of active in-the-wild exploitation reported.

Business Impact

Unprivileged local users can overwrite root-owned files (including /etc/passwd and setuid binaries) and gain persistent root access on vulnerable systems. The race condition at the XFS block layer leaves no kernel warnings or log entries, and modifications survive reboot with original metadata intact. Critical risk for multi-tenant environments, CI/CD pipelines, shared hosting, and any system where untrusted code runs locally. Red Hat issued patches July 14–17, eight days before public disclosure; organizations that applied those updates are already protected.

Urgency

🔴 Immediate

Recommended Actions

  • Verify XFS reflink status on all filesystems with 'xfs_info / | grep reflink=' and 'xfs_info | grep reflink=' — reflink=1 indicates exposure.
  • Apply vendor kernel updates immediately: RHEL 8 (RHSA-2026:39179, RHSA-2026:39180), RHEL 10 (RHSA-2026:39494), Debian trixie-security (kernel 6.12.96-1+), unstable (7.1.4-1+), and equivalent updates for Fedora, Amazon Linux, and other distributions.
  • Reboot all patched systems to load the fixed kernel; verify running kernel version with 'uname -r' and cross-reference against vendor advisories.
  • Prioritize patching for multi-tenant hosts, CI/CD workers, shared development servers, and any system where untrusted users or services have local shell or code execution.
  • Review logs and file integrity monitoring for unexplained changes to /etc/passwd, /etc/shadow, and setuid binaries (e.g., /usr/bin/sudo, /usr/bin/su) between April 2017 and patch date; note that the exploit leaves no kernel log traces.