How RefluXFS Overwrites Root Owned Files You Can Only Read

RefluXFS (CVE-2026-64600) is a race condition in the Linux kernel's XFS copy-on-write path, and it is far more useful to an attacker than ordinary filesystem corruption. An unprivileged local user asks XFS for a reflinked copy of a file they can read, races two direct writes against that copy, and the kernel trusts a stale block mapping long enough to land one of those writes in the original. The overwrite happens at the block layer, so it survives a reboot, leaves owner, timestamps, and setuid bits intact, and produces no kernel log entry. In this live stream, we cover how an AI-assisted hunt surfaced the flaw, why turning reflink off is not an emergency option, what the SystemTap mitigation costs a workload, and why the correction fits a rebootless patch.