CVE-2026-64600 – RefluXFS Detection & Mitigation Tool

This repository provides a comprehensive C utility to detect, safely verify, and mitigate the RefluXFS vulnerability (CVE‑2026‑64600) on Linux systems running the XFS filesystem. The tool checks for a vulnerable kernel, identifies reflink‑enabled XFS mounts, optionally attempts a safe race‑trigger, and deploys a two‑layer mitigation (SystemTap probe + remount with reflink=0) when needed.

⚠️ Disclaimer: This tool is intended for authorised security assessment and system hardening only. Use it only on systems you own or have explicit permission to test. The authors assume no liability for misuse.

🔥 Vulnerability Overview

CVE-2026-64600 (RefluXFS) is a high‑severity race condition in the Linux kernel’s XFS filesystem, specifically in the copy‑on‑write (CoW) path for reflinked files (introduced in kernel 4.11). An unprivileged local attacker can corrupt or overwrite arbitrary files on the same XFS volume by racing concurrent O_DIRECT writes on a reflink clone against a protected file. The corruption occurs at the block layer, survives reboots, and leaves no trace in kernel logs.

Affected Kernels: Linux 4.11 through fixed versions:

• 6.12.96+
• 6.18.39+
• 7.1.4+
• 7.2‑rc4+

Impact: Local privilege escalation to root, persistent data corruption, silent overwrite of setuid binaries or sensitive files.

This tool implements:

• Kernel version detection (against the fixed boundaries).
• XFS reflink mount detection (checks /proc/mounts).
• Safe race verification (non‑destructive PoC that creates temporary files and attempts to trigger the race).
• Layered mitigation (when -m fix is used):
  1. SystemTap probe – intercepts FICLONE and copy_file_range syscalls on XFS, returning -EOPNOTSUPP.
  2. Remount hardening – attempts to remount XFS volumes with reflink=0 (defence in depth).
• Interactive kernel remediation advisory – prompts for patched version and distro‑specific upgrade commands.
• Custom command execution (-c) – run arbitrary commands (e.g., id) only if the system is vulnerable.

✨ Features

• Non‑root detection – checks kernel version and XFS reflink status without elevated privileges.
• Safe verification – optional non‑destructive race trigger test (-m exploit).
• Layered mitigation – deploys SystemTap probe and remounts XFS with reflink=0 (-m fix, requires root).
• --dry-run – preview mitigation actions without applying them.
• --force – force mitigation deployment even if conditions are not met (lab/demo).
• Interactive advisory – when vulnerable, prompts to show patched version and upgrade commands.
• Verbose output (-v) for detailed parsing information.
• Custom command (-c) – execute a command only if the system is vulnerable (default: id).
• Professional, colour‑coded output – clear status messages and verdicts.

📦 Compilation & Installation

git clone https://github.com/Debajyoti0-0/CVE-2026-64600.git
cd cve-2026-64600
gcc -o cve-2026-64600 cve-2026-64600.c -lm -lpthread

Prerequisites:

• Linux system with kernel 4.11 or newer (or older for detection).
• For mitigation (-m fix):
  • root privileges (required for remount and stap probe).
  • SystemTap installed (stap command) – optional, but recommended for full mitigation.
  • XFS filesystem with reflink enabled (for the vulnerability to be exploitable).

Optional: If SystemTap is not available, the tool will fall back to remount hardening only (if supported by the XFS version).

🚀 Usage

Single target – detection only

./cve-2026-64600

Detection with verbose output

./cve-2026-64600 -v

Check a specific path for XFS reflink

./cve-2026-64600 -p /mnt/data

Safe race verification (PoC)

./cve-2026-64600 -m exploit

Auto mode – check + verify if vulnerable

./cve-2026-64600 -m auto

Apply mitigation (requires root)

sudo ./cve-2026-64600 -m fix

Preview mitigation actions without applying

sudo ./cve-2026-64600 -m fix --dry-run

Force mitigation even if conditions not met (lab only)

sudo ./cve-2026-64600 -m fix --force

Run a custom command when vulnerable (e.g., show current user)

./cve-2026-64600 -c "whoami"

Run custom command with verbose output

./cve-2026-64600 -v -c "id"

⚙️ Flags Reference

Modes in detail

📝 Example Outputs

Detection on a non‑vulnerable system (no XFS reflink)

$ ./cve-2026-64600

┌──────────────────────────────────────────────────────────────────────┐
│ CVE-2026-64600 (RefluXFS) — Mode: check                              │
└──────────────────────────────────────────────────────────────────────┘

─── System Information ───
  Kernel                    5.15.0-91-generic
  Architecture              x86_64
─── Vulnerability Assessment ───
  Kernel Vulnerable         NO
  XFS Reflink (any mount)   DISABLED
  Distribution Affected (heuristic) NO

  ────────────────────────────────────────────────────────────────────
  FINAL VERDICT
  ────────────────────────────────────────────────────────────────────
┌──────────────────────────────────────────────────────────────────────┐
│ SAFE: kernel not vulnerable and no XFS reflink found                 │
└──────────────────────────────────────────────────────────────────────┘
  Kernel: 5.15.0-91-generic (not vulnerable)
  XFS reflink: not detected
  System appears secure against CVE-2026-64600
  ────────────────────────────────────────────────────────────────────

Detection on a system with a vulnerable kernel but no XFS reflink (partial risk)

$ ./cve-2026-64600

┌──────────────────────────────────────────────────────────────────────┐
│ CVE-2026-64600 (RefluXFS) — Mode: check                              │
└──────────────────────────────────────────────────────────────────────┘

─── System Information ───
  Kernel                    6.12.0-rc2
  Architecture              x86_64
─── Vulnerability Assessment ───
  Kernel Vulnerable         YES
  XFS Reflink (any mount)   DISABLED
  Distribution Affected (heuristic) YES

  A vulnerable kernel was detected. Show remediation advisory? [y/n]: n

  ────────────────────────────────────────────────────────────────────
  FINAL VERDICT
  ────────────────────────────────────────────────────────────────────
┌──────────────────────────────────────────────────────────────────────┐
│ PARTIAL: vulnerable kernel, but no XFS reflink found                 │
└──────────────────────────────────────────────────────────────────────┘
  Kernel: 6.12.0-rc2 (vulnerable)
  XFS reflink: not detected
  Recommendation: still consider kernel update as precaution
  ────────────────────────────────────────────────────────────────────

Full mitigation on a confirmed vulnerable system

$ sudo ./cve-2026-64600 -m fix

┌──────────────────────────────────────────────────────────────────────┐
│ CVE-2026-64600 (RefluXFS) — Mode: fix                                │
└──────────────────────────────────────────────────────────────────────┘

─── System Information ───
  Kernel                    6.12.0-rc2
  Architecture              x86_64
─── Vulnerability Assessment ───
  Kernel Vulnerable         YES
  XFS Reflink (any mount)   ENABLED
  Distribution Affected (heuristic) YES

--- Mitigation Deployment ---
  Layer 2/2: mount-level hardening (remount reflink=0)
  Remounted /mnt/xfs with reflink=0

  Layer 1/2: syscall-level block (SystemTap probe)
  Status                    DEPLOYED (SystemTap)
  Log:  /var/log/refluxfs-block.log
  Stop: sudo pkill -f 'stap.*refluxfs-block'
  Verify: cp --reflink=always /etc/passwd /tmp/test 2>&1 | grep -q 'Operation not supported'

  Status                    MITIGATION ACTIVE (both layers)

--- FINAL VERDICT ---
┌──────────────────────────────────────────────────────────────────────┐
│ CONFIRMED VULNERABLE (race triggered)                                │
└──────────────────────────────────────────────────────────────────────┘
  Kernel: 6.12.0-rc2 (vulnerable)
  XFS reflink: enabled
  Distribution: affected

🛠️ Building a Vulnerable Test Environment

To test this tool in a safe environment, you can set up a Linux VM with an XFS partition created with reflink=1. For example:

# Create a loop device with an XFS filesystem (reflink enabled)
dd if=/dev/zero of=/tmp/xfs.img bs=1M count=1024
mkfs.xfs -m reflink=1 /tmp/xfs.img
sudo mount -o loop /tmp/xfs.img /mnt/xfs

Then run the tool on the mounted path (-p /mnt/xfs) to test detection and mitigation.

🔗 References

• NIST NVD – CVE-2026-64600
• Linux kernel upstream commit 2f4acd0fcd86
• XFS reflink documentation
• CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

📜 License

This project is licensed under the GNU General Public License v3.0 – see the LICENSE file for details.

🤝 Contributing

Issues and pull requests are welcome. Please ensure your contributions maintain the same functionality and adhere to the ethical usage guidelines.

Remember: Always obtain proper authorisation before testing any security tool. Stay ethical and responsible.