RefluXFS (CVE-2026-64600) is a Linux kernel Local Privilege Escalation in the XFS filesystem, present in every kernel from v4.11 (April 2017) onward. On an affected host, an unprivileged local user can gain root, with no capabilities, namespaces, or special hardware required. It was discovered by Qualys and publicly disclosed on 2026-07-22 via oss-security.
This page is a running status tracker for RefluXFS across all CloudLinux delivery streams — a live snapshot of what is patched, what is pending, and how to install each fix. Snapshot: 2026-07-23.
Consolidated status matrix
| CL Version | Kernel | Affected | CL Kernel | KernelCare | Mitigation available |
| CL | 3.10 | ✅ not affected | — (kernel too old to contain the bug) | — | — |
| CL7h | 4.18 | ❌ affected | ✅ kernel-4.18.0-553.144.1.lve.el7h (rollout) |
⏳ coming soon | ✅ kernel update or KernelCare patch |
| CL8 | 4.18 | ❌ affected | ✅ kernel-4.18.0-553.144.1.lve.el8 (rollout) | ✅ main feed | ✅ kernel update or KernelCare patch |
| CL9 | 5.14 | ❌ affected | ✅ kernel-5.14.0-687.26.1.el9_8 (via AlmaLinux) — install → |
✅ main feed | ✅ kernel update or KernelCare patch |
| CL10 | 6.12 | ❌ affected | ✅ kernel-6.12.0-211.34.1.el10_2 (via AlmaLinux) — install → |
✅ main feed | ✅ kernel update or KernelCare patch |
| CL for Ubuntu 22.04 | 5.15 | ✅ not affected (unless XFS with reflink is mounted) | — (uses Ubuntu kernel) | — | — |
| CL8 LTS | 4.18 / 5.14 (TuxCare ELS) | ❌ affected | ⏳ coming soon | — | ✅ kernel update or KernelCare patch |
| CL9 LTS | 5.14 (TuxCare ELS) | ❌ affected | ⏳ coming soon | — | ✅ kernel update or KernelCare patch |
Legend: ❌ affected · ✅ not affected / patched · ⏳ coming soon · ❓ unknown · — not applicable
Why This Matters on a Shared Host
The vulnerability creates a dangerous escalation path. On an unpatched host the chain is short, and none of it needs special access:
- Web-tier compromise. An attacker exploits a vulnerable plugin or outdated CMS, gaining access as an unprivileged process confined to a single site.
- RefluXFS exploitation. From that restricted process, the attacker leverages RefluXFS to become root without prior elevated privileges.
- Full server compromise. With root access, the attacker escapes all tenant boundaries and security limits, gaining access to every other tenant’s files, databases, credentials, and backups on that server.
On a patched host — or one running a KernelCare livepatch — step 2 fails: a web-tier compromise stays a web-tier compromise, one site to clean up rather than a whole server to rebuild. That is the practical difference the kernel fix delivers in multi-tenant hosting environments.
Installation instructions (CloudLinux)
CloudLinux 9 / 10 track AlmaLinux kernels directly — installing the AlmaLinux kernel is the CloudLinux install path.
CL9 + CL10 — AlmaLinux fixed kernels (published 2026-07-15→16)
Target versions: kernel-5.14.0-687.26.1.el9_8 (CL9) and kernel-6.12.0-211.34.1.el10_2 (CL10).
For CL10:
dnf update 'kernel*'reboot
For CL9:
dnf update 'kernel*'reboot
CL7h + CL8 — CloudLinux kernel rebuild (rollout repo)
Target versions: kernel-4.18.0-553.144.1.lve.el7h (CL7h) and kernel-4.18.0-553.144.1.lve.el8 (CL8). Both are available in the CloudLinux rollout repo. Once promoted to the stable channel, a plain yum update 'kernel*'; reboot is sufficient. CL7 is not affected (kernel too old to contain the bug).
CL8 LTS / CL9 LTS
Pending — see status matrix above.
Mitigation options
Mitigation for RefluXFS is one of two options: (1) update to the vendor-fixed kernel listed in the status matrix above and reboot; or (2) apply the KernelCare livepatch once available on your CloudLinux version — no reboot required. There is no reliable non-kernel workaround; targeting reflink, setuid bits, or filesystem layout does not close the primitive.
Comments