The RefluXFS vulnerability, tracked as CVE-2026-64600, is a serious race-condition flaw residing in the Linux kernel’s XFS filesystem copy-on-write path. Affecting kernel versions 4.11 and later, the bug allows an unprivileged local user to overwrite protected system files by exploiting a timing window during concurrent direct I/O operations. Because the manipulation occurs at the block layer, it effectively bypasses common security controls, including SELinux, kernel lockdown, and standard memory protections.
Source