ID:12876 - Exploit for Race condition in Linux kernel - CVE-2026-64600

Vulnerability identifier: #VU139250

Vulnerability risk: Low

CVE-ID: CVE-2026-64600

CWE-ID: CWE-362

Exploitation vector: Local access

Vulnerable software:
Linux kernel
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
openEuler
kpatch-patch-4_18_0-477_143_1 (Red Hat package)
kpatch-patch-4_18_0-553_125_1 (Red Hat package)
kpatch-patch-5_14_0-284_172_1 (Red Hat package)
kpatch-patch-5_14_0-687_10_1 (Red Hat package)
kpatch-patch-6_12_0-211_16_1 (Red Hat package)
kpatch-patch-5_14_0-427_126_1 (Red Hat package)
kpatch-patch-5_14_0-570_116_1 (Red Hat package)
kpatch-patch-4_18_0-477_130_1 (Red Hat package)
kpatch-patch-4_18_0-553_109_1 (Red Hat package)
kpatch-patch-5_14_0-284_158_1 (Red Hat package)
kpatch-patch-5_14_0-427_113_1 (Red Hat package)
kpatch-patch-5_14_0-570_94_1 (Red Hat package)
kpatch-patch-4_18_0-477_120_1 (Red Hat package)
kpatch-patch-4_18_0-553_85_1 (Red Hat package)
kpatch-patch-5_14_0-284_148_1 (Red Hat package)
kpatch-patch-4_18_0-477_107_1 (Red Hat package)
kpatch-patch-5_14_0-427_100_1 (Red Hat package)
kpatch-patch-5_14_0-570_66_1 (Red Hat package)
kpatch-patch-4_18_0-553_72_1 (Red Hat package)
kpatch-patch-5_14_0-284_134_1 (Red Hat package)
kpatch-patch-5_14_0-570_39_1 (Red Hat package)
kpatch-patch-5_14_0-427_84_1 (Red Hat package)
kpatch-patch-4_18_0-477_97_1 (Red Hat package)
kpatch-patch-4_18_0-553_53_1 (Red Hat package)
kpatch-patch-5_14_0-284_117_1 (Red Hat package)
kpatch-patch-5_14_0-427_68_2 (Red Hat package)
kpatch-patch-5_14_0-570_17_1 (Red Hat package)
kernel
kernel-abi-stablelists
kernel-doc
bpftool
kernel-core
kernel-cross-headers
kernel-debug
kernel-debug-core
kernel-debug-devel
kernel-debug-modules
kernel-debug-modules-extra
kernel-headers
kernel-modules
kernel-modules-extra
kernel-tools
kernel-tools-libs
kernel-tools-libs-devel
perf
python3-perf
kernel-devel
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-source
kernel-tools-debuginfo
kernel-tools-devel
perf-debuginfo
python2-perf
python2-perf-debuginfo
python3-perf-debuginfo

https://github.com/litosmartin/CVE-2026-64600-Refluxfs-PoC

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc in the XFS reflink code when processing direct I/O writes after cycling the ILOCK. A local user can trigger a racing direct I/O write operation to cause a denial of service.

The issue occurs because a stale data fork mapping can be used after the ILOCK is dropped and reacquired, which can result in incorrect shared-block state during copy-on-write handling.

Install security update from vendor's repository.