A high severity vulnerability in the Linux kernel XFS subsystem allows local authenticated users to compromise system integrity and confidentiality.

This is a race condition and stale pointer issue within the XFS filesystem driver, specifically involving data fork mappings and ILOCK cycling, requiring low local privileges and no user interaction.

A successful exploit could allow a malicious local user to gain elevated privileges, manipulate sensitive files, or cause a denial of service through kernel panics. The CVSS score of 7.8 indicates high severity because, while local access is required, successful exploitation compromises the confidentiality, integrity, and availability of the underlying operating system.

Immediate Action: Update the Linux kernel to version 5.15.212, 6.1.178, 6.6.145, 6.12.96, or later depending on the active release branch.

Proactive Monitoring: Monitor system logs for kernel traces, segmentation faults, or unauthorized privilege escalation attempts.

Compensating Controls: Restrict local shell access and auditing user accounts to limit potential threat actors who could execute local exploit code.

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub, including CVE-2026-64600-RefluXFS-PoC.

Given the availability of public proof-of-concept code and the high potential impact on core system integrity, administrators must prioritize updating kernel packages. Apply the vendor-supplied patches immediately across all affected Linux environments to mitigate local escalation risks.