A nine-year-old Linux kernel flaw, RefluXFS (CVE-2026-64600), has been disclosed, allowing unprivileged local users to gain persistent root access. This race condition in the XFS filesystem’s copy-on-write path enables attackers to overwrite root-owned files. Qualys demonstrated its exploitability on default installations of Red Hat Enterprise Linux, Fedora Server, and Amazon Linux, even with SELinux in enforcing mode.