Here we go again: Another Linux kernel vulnerability has been discovered that could grant standard users root privileges. This time, the flaw could affect over 16 million systems. The vulnerability, CVE-2026-64600 (nicknamed RefluXFS), hits any system using the XFS filesystem.

The vulnerability was discovered by the Qualys Threat Research Unit as part of a research project using Anthropic's Claude Mythos Preview. Qualys first reported the vulnerability as "a race condition in the Linux kernel’s XFS filesystem copy-on-write path." The report goes on to say, "An attacker with an ordinary local account can exploit this race condition to overwrite protected files on disk and gain host root privileges on affected systems, including deployments running SELinux in Enforcing mode."

As for how they discovered the flaw, Qualys said, "we tasked Claude Mythos Preview with hunting for a Dirty COW–style race condition in the Linux kernel, iteratively refining our prompts to narrow its focus toward race conditions in the core memory-management and filesystem directories." It took several iterations, but eventually "the model identified a race condition in the XFS filesystem and generated a functional proof-of-concept local privilege escalation."

The vulnerability has existed since kernel 4.11, and Qualys determined this was rated as an emergency priority because exploitation could happen using ordinary local privileges.

Immediate kernel patching is required to mitigate this threat. Kernels that include those patches are now available from vendors.