Affected Systems

Linux kernel 4.11+ (2017–2026) on systems with XFS filesystems created with reflink=1. Default installations of RHEL/CentOS Stream/Oracle/Rocky/AlmaLinux/CloudLinux 8/9/10, Fedora Server 31+, Amazon Linux 2023, and Amazon Linux 2 (Dec 2022+) are vulnerable. Debian, Ubuntu, SLES, openSUSE affected only if XFS with reflink was manually chosen. RHEL 7 not affected.

Exploitation Status

Working proof-of-concept published by Qualys. Exploit typically succeeds in under 10 seconds on vulnerable systems. No evidence of active exploitation in the wild reported at disclosure.

Business Impact

Unprivileged local users can overwrite root-owned files (including /etc/passwd and setuid binaries) and gain persistent root access. The overwrite survives reboot, leaves metadata unchanged, and produces no kernel warnings or logs. Critical risk for multi-tenant environments, CI/CD pipelines, shared hosting, and any system where untrusted code runs locally. Red Hat issued patches July 14–17, eight days before public disclosure; organizations that applied those updates are already protected.

Urgency

🔴 Immediate

Recommended Actions

  • Verify XFS reflink status on all filesystems with 'xfs_info / | grep reflink=' and 'xfs_info | grep reflink=' for additional volumes; reflink=1 indicates exposure.
  • Apply vendor kernel updates immediately: RHEL 8 (RHSA-2026:39179, RHSA-2026:39180), RHEL 10 (RHSA-2026:39494), Debian trixie-security (kernel 6.12.96-1+), unstable (7.1.4-1+), and equivalent updates from Fedora, Amazon Linux, and other distributions.
  • Reboot all patched systems to load the fixed kernel; the vulnerability persists until the new kernel is running.
  • Prioritize patching for multi-tenant hosts, CI/CD workers, shared development environments, and any system where untrusted users or code can execute locally.
  • Review /etc/passwd and setuid-root binaries (find / -perm -4000 -user root 2>/dev/null) for unexpected modifications on systems that were exposed before patching; compare checksums against known-good baselines or reinstall if integrity is uncertain.