CVE-2026-64600

exploited in the wild☆ pin

CVSS

—

Reports

First seen

Jul 23, 2026

Last seen

Jul 24, 2026

Affected product

Linux kernel 4.11+; XFS filesystems with reflink=1 on RHEL 8/9/10, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, Fedora Server 31+, Amazon Linux 2023, Amazon Linux 2 (Dec 2022+)

Recent reports

High

High Threat Security Alert: RefluXFS Linux Kernel Privilege Escalation Vulnerability

GovCERT.HKJul 24, 2026 High

RefluXFS Linux kernel flaw allows local privilege escalation via XFS race condition

Bleeping ComputerJul 23, 2026 High

RefluXFS: Nine-Year-Old Linux Kernel Flaw Enables Local Privilege Escalation on Default RHEL

The Hacker NewsJul 23, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.