RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)

As a security researcher who has published a few vulns with "cute" names, it's often just fun to come up with something slightly amusing and punny for the blog article title. It's not that I consider these vulns groundbreaking (most of them have been less-than-impressive) or that I specifically think the vuln needs a name, but I think there's no harm in trying to come up with something a bit more colorful or creative besides just a regular CVE ID. I don't think it matters much if the rest of the write up is strictly technical and the vuln and exploit are solid (as in this case) - unless you're allergic to a little bit of fun.

Designing a whole logo, purchasing a domain for it and dedicating an entire site just for a single vuln is usually a bit too much for me, though.

I don't know anything about this particular vulnerability, but seeing this name I thought how with proliferation of AI researched exploits names/logos/sites will get automatically proposed right away with an exploit.

Now, taking a look at the article:

(...)

Discovery process and research methodology

For this research, we tasked Claude Mythos Preview with hunting for a Dirty COW–style race condition in the Linux kernel, iteratively refining our prompts to narrow its focus toward race conditions in the core memory-management and filesystem directories. After several iterations, the model identified a race condition in the XFS filesystem and generated a functional proof-of-concept local privilege escalation. Our security researchers then took over: we reviewed the model’s reasoning, reproduced the exploit, and independently verified every technical claim before coordinating disclosure with upstream maintainers. The model also produced an initial draft of the advisory, which our team validated and corrected against our own testing. This human-validated, AI-accelerated approach let us surface a complex kernel race condition while holding to the strict accuracy and responsible-disclosure standards expected; every finding here cleared the same evidence bar we apply to any Qualys security advisory.

Find out more about Qualys’ participation in Anthropic’s Project Glasswing. Read More

(...)