CVE-2026-64600
HIGHxfs: resample the data fork mapping after cycling ILOCK
Title source: cnaExploitation Summary
EIP tracks 6 public exploits for CVE-2026-64600. PoCs published by letsr00t, bha-vin, Debajyoti0-0.
AI-analyzed exploit summary This repository provides a bash script that checks for the presence of CVE-2026-64600 (RefluxFS) vulnerability by analyzing kernel version, XFS filesystem configurations, and patch indicators. It does not contain exploit code but detects potential vulnerability conditions.
Description
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.
Exploits (6)
This repository provides a bash script that checks for the presence of CVE-2026-64600 (RefluxFS) vulnerability by analyzing kernel version, XFS filesystem configurations, and patch indicators. It does not contain exploit code but detects potential vulnerability conditions.
Exploits a race condition in the Linux kernel XFS copy-on-write (reflink) path to achieve local privilege escalation by clearing the root password in /etc/passwd. Uses multi-threaded O_DIRECT writes to trigger the vulnerability.
This repository provides a detection and mitigation tool for CVE-2026-64600, a race condition in the Linux kernel's XFS filesystem (RefluXFS) affecting reflink-enabled volumes. The PoC safely verifies the vulnerability by triggering a non-destructive race condition and offers layered mitigation (SystemTap probe + remount with reflink=0).
The repository claims to be an 'advanced weaponized exploit framework' for CVE-2026-64600 (RefluXFS kernel LPE), but the provided Bash script is a non-functional stub with no actual exploit code. It contains extensive marketing language, hardcoded credentials, and framework scaffolding without demonstrating the vulnerability mechanics.
This repository contains no actual exploit code, technical details, or vulnerability analysis for CVE-2026-64600. It only includes a README with donation requests, setup instructions for a Python virtual environment, and legal disclaimers, but no functional PoC or research content.
This repository claims to analyze CVE-2026-64600, a Linux kernel memory corruption vulnerability in the RefluxFS filesystem implementation leading to local privilege escalation. However, it contains no actual exploit code, technical details, or proof-of-concept, only high-level descriptions and placeholder documentation.
References (11)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H