**By:** webdevel@sparkhausmedia.com (Gwen Clark)
Affecting millions of systems, a kernel flaw discovered by Qualys could allow users to gain root privileges.
Here we go again: Another Linux kernel vulnerability has been discovered that could grant standard users root privileges.
This time, the flaw could affect over 16 million systems.
The vulnerability, CVE-2026-64600 (nicknamed RefluXFS), hits any system using the XFS filesystem.
The vulnerability was discovered by the Qualys Threat Research Unit as part of a research project using Anthropic’s Claude Mythos Preview.
Qualys first reported the vulnerability as “a race condition in the Linux kernel’s XFS filesystem copy-on-write path.” The report goes on to say, “An attacker with an ordinary local account can exploit this race condition to overwrite protected files on disk and gain host root privileges on affected systems, including deployments running SELinux in Enforcing mode.”
As for how they discovered the flaw, Qualys said, “we tasked Claude Mythos Preview with hunting for a Dirty COW–style race condition in the Linux kernel, iteratively refining our prompts to narrow its focus toward race conditions in the core memory-management and filesystem directories.” It took several iterations, but eventually “the model identified a race condition in the XFS filesystem and generated a functional proof-of-concept local privilege escalation.”
The vulnerability has existed since kernel 4.11, and Qualys determined this was rated as an emergency priority because exploitation could happen using ordinary local privileges.
Immediate kernel patching is required to mitigate this threat.
Kernels that include those patches are now available from vendors.
Qualys has discovered a vulnerability in the Linux kernel that can be used to elevate standard user privileges.
Qualys researchers have discovered two local privilege escalation vulnerabilities that allow hackers to gain root privileges on major Linux distributions.
Looney Tunables is a new Linux vulnerability that has been discovered in the GNU C library that can lead to privilege escalation.
A vulnerability has been discovered in the Linux sudo command that’s been hiding in plain sight.
In the news: Zorin OS 16 Educational Spin Now Available; System76 Releases AMD-Powered Kudu Laptop; Ubuntu Budgie Sets Its Sights on Gamers: Linux Mint Edge Is Ready for the Newest Hardware; Linux Kernel 5.17 Code Merge Window Is Closed; and Another Serious Flaw Found in All Major Linux Distributions.
Thanks to AI bug hunters, the Linux kernel is seeing record numbers of vulnerabilities, and it’s overwhelming developers.
So long as Linux is distributed under the GPL, MIT, BSD, and Apache licenses, the OS is exempt from being required to verify the age of its users in California.
35 years ago, a Finnish student began a humble project that would forever change the course of technology.
China has ordered several government agencies to drop a Chinese-developed version of Windows 10 in favor of either KylinOS or UOS.
With continued DRAM and eMMC shortages, Pine64 has decided to discontinue production of Linux devices.
KDE, Techpaladin, and Kubuntu Focus have announced a new initiative that will provide at least three years of support for KDE Plasma 6.6 LTS and related software.
For those on Linux Mint who like to keep multiple kernels around but don’t want them to take up too much space, you might be getting a new automated tool.
CachyOS August 2026 release is now available with the latest version of KDE, some new features, and plenty of improvements.
Unless a kernel patch is a valid security fix, it will be rejected if it was created using AI.
According to two sources, the Linux operating system has hit a major milestone in market share that naysayers thought would never happen.
—
**📚 Original Source:**
[Yet Another Linux Kernel Vulnerability Discovered](http://www.linux-magazine.com/Online/News/Yet-Another-Linux-Kernel-Vulnerability-Discovered)
About The Author
