Skip to main content

Linux CVE-2026-64600

| EUVDEUVD-2026-47879 HIGH
Race Condition (CWE-362)
2026-07-22 GHSA-6p99-w6f4-qcvq
Information Disclosure Linux Race Condition
7.8
CVSS 3.1 · Vendor
View

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 29, 2026

Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.

Affected VersionsENISA

Linux patch: 7.1.4
Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 <2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7
Linux patch: 6.18.39
Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 <44f891bc088958399eec27f7604928694aa35581
Linux patch: 7.2-rc4
Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 <e705d81a7193dd19e69b8e2bad4696d78a4ea075
Linux 4.11
Linux patch: 6.12.96
Linux patch: 0
Linux 3c68d44a2b49a0ac9165faa9c191e1e618c8a8d5 <206c09b04dc5469c7ff14d8aceff2d47c88078d9

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.5 HIGH

Local access and unprivileged account required (AV:L/PR:L); race condition adds complexity (AC:H); scope changes because writes land in root-owned files outside attacker's security domain (S:C); full confidentiality and integrity over any readable file on the volume (C:H/I:H); no availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 27, 2026 - 05:22 NVD
7.8 (HIGH)
Patch available
Jul 23, 2026 - 07:17 EUVD
CVE Published
Jul 22, 2026 - 16:49 oss-security
HIGH
CVE Published
Jul 22, 2026 - 16:49 oss-security
HIGH 7.8

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

medium.com CVE-2026-64600 (RefluXFS): Linux Kernel XFS Race Condition Allows Unprivileged Local Root Aug 02, 2026

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Threat Intel
1
1 sources
Social Media
5
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS NEWS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHBA-2026:39332 ADVISORY https://access.redhat.com/errata/RHBA-2026:41013 ADVISORY https://access.redhat.com/errata/RHBA-2026:41254 ADVISORY https://access.redhat.com/errata/RHSA-2026:39179 ADVISORY https://access.redhat.com/errata/RHSA-2026:39180 ADVISORY https://access.redhat.com/errata/RHSA-2026:39494 ADVISORY https://access.redhat.com/errata/RHSA-2026:39984 ADVISORY https://access.redhat.com/errata/RHSA-2026:40425 ADVISORY https://access.redhat.com/errata/RHSA-2026:41062 ADVISORY https://access.redhat.com/errata/RHSA-2026:41063 ADVISORY https://access.redhat.com/errata/RHSA-2026:41229 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64600 ADVISORY https://seclists.org/oss-sec/2026/q3/214 ADVISORY https://seclists.org/oss-sec/2026/q3/218 ADVISORY https://seclists.org/oss-sec/2026/q3/219 ADVISORY https://seclists.org/oss-sec/2026/q3/357 ADVISORY https://seclists.org/oss-sec/2026/q3/390 ADVISORY https://seclists.org/oss-sec/2026/q3/394 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/382470 REF http://www.openwall.com/lists/oss-security/2026/07/22/14 REF http://www.openwall.com/lists/oss-security/2026/07/22/18 REF http://www.openwall.com/lists/oss-security/2026/07/22/19 REF http://www.openwall.com/lists/oss-security/2026/07/31/3 REF http://www.openwall.com/lists/oss-security/2026/08/03/4 REF http://www.openwall.com/lists/oss-security/2026/08/03/8 REF https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt REF https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9 REF https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 REF https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581 REF https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f REF https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05 REF https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18 REF https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy