{"schema":"vulnpedia.research/1","cve":"CVE-2026-64600","references":[{"url":"https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18","tags":["Patch"],"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","origins":[{"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","url":"https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18"}]},{"url":"https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05","tags":["Patch"],"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","origins":[{"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","url":"https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05"}]},{"url":"https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f","tags":["Patch"],"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","origins":[{"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","url":"https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f"}]},{"url":"https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075","tags":["Patch"],"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","origins":[{"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","url":"https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075"}]},{"url":"https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9","tags":["Patch"],"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","origins":[{"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","url":"https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9"}]},{"url":"https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581","tags":["Patch"],"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","origins":[{"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","url":"https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581"}]},{"url":"https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7","tags":["Patch"],"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","origins":[{"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","url":"https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7"}]},{"url":"https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt","tags":["Exploit","Third Party Advisory","vendor-reference"],"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","origins":[{"source":"mitre","sourceId":"Linux","modified":"2026-08-17T04:58:23.073Z","url":"https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt"},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/22/14","tags":["Exploit","Mailing List"],"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","url":"http://www.openwall.com/lists/oss-security/2026/07/22/14"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"http://www.openwall.com/lists/oss-security/2026/07/22/14"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/22/18","tags":["Mailing List"],"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","url":"http://www.openwall.com/lists/oss-security/2026/07/22/18"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"http://www.openwall.com/lists/oss-security/2026/07/22/18"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/22/19","tags":["Mailing List"],"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","url":"http://www.openwall.com/lists/oss-security/2026/07/22/19"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"http://www.openwall.com/lists/oss-security/2026/07/22/19"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/31/3","tags":["Mailing List"],"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","url":"http://www.openwall.com/lists/oss-security/2026/07/31/3"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"http://www.openwall.com/lists/oss-security/2026/07/31/3"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/03/4","tags":["Mailing List"],"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","url":"http://www.openwall.com/lists/oss-security/2026/08/03/4"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"http://www.openwall.com/lists/oss-security/2026/08/03/4"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/03/8","tags":["Mailing List"],"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-08-03T20:31:20.507Z","url":"http://www.openwall.com/lists/oss-security/2026/08/03/8"},{"source":"nvd","sourceId":"CVE-2026-64600","modified":"2026-10-19T21:17:49.500","url":"http://www.openwall.com/lists/oss-security/2026/08/03/8"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-64600","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-64600"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498915","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498915"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64600","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-64600"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64600","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64600"}]},{"url":"https://access.redhat.com/errata/RHBA-2026:39321","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHBA-2026:39321"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:39494","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:39494"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:41063","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:41063"}]},{"url":"https://access.redhat.com/errata/RHBA-2026:39332","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHBA-2026:39332"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:41062","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:41062"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:39179","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:39179"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:39984","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:39984"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:41229","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:41229"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:47997","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:47997"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:47984","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:47984"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:47983","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:47983"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:40425","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:40425"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:39180","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:39180"}]},{"url":"https://access.redhat.com/errata/RHBA-2026:41013","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHBA-2026:41013"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:46951","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:46951"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:47998","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:47998"}]},{"url":"https://access.redhat.com/errata/RHBA-2026:41254","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHBA-2026:41254"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:48016","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:48016"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:47981","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://access.redhat.com/errata/RHSA-2026:47981"}]},{"source":"euvd","sourceId":"EUVD-2026-47879","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47879","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-47879","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47879"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/0xBlackash/CVE-2026-64600","source":"poc-in-github","sourceId":"CVE-2026-64600","description":"CVE-2026-64600","modified":"2026-08-20T08:08:58Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/0xBlackash/CVE-2026-64600"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-08-20T08:08:58Z","url":"https://github.com/0xBlackash/CVE-2026-64600"}],"tags":[]},{"url":"https://github.com/HORKimhab/CVE-2026-64600","source":"poc-in-github","sourceId":"CVE-2026-64600","description":"CVE-2026-64600 - Draft - Check todo","modified":"2026-08-24T18:46:35Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/HORKimhab/CVE-2026-64600"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-08-24T18:46:35Z","url":"https://github.com/HORKimhab/CVE-2026-64600"}],"tags":[]},{"url":"https://github.com/vulnquest58/VQ-RefluxCore","source":"poc-in-github","sourceId":"CVE-2026-64600","description":"is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation (LPE) mechanics associated with kernel-level race conditions and filesystem structure vulnerabilities (CVE-2026-64600 / RefluXFS)","modified":"2026-08-06T06:18:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/vulnquest58/VQ-RefluxCore"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-08-06T06:18:29Z","url":"https://github.com/vulnquest58/VQ-RefluxCore"}],"tags":[]},{"url":"https://github.com/Debajyoti0-0/CVE-2026-64600","source":"poc-in-github","sourceId":"CVE-2026-64600","description":"A C-based Linux security utility for detecting, safely verifying (Proof of Concept), and mitigating CVE-2026-64600 (RefluXFS). It provides kernel vulnerability assessment, XFS reflink detection, a safe race-condition PoC, and layered mitigation using SystemTap and XFS hardening.","modified":"2026-09-22T17:10:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/Debajyoti0-0/CVE-2026-64600"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-09-22T17:10:29Z","url":"https://github.com/Debajyoti0-0/CVE-2026-64600"}],"tags":[]},{"url":"https://github.com/litosmartin/CVE-2026-64600-Refluxfs-PoC","source":"poc-in-github","sourceId":"CVE-2026-64600","description":"A POC for the recently discovered Qualys bug on COW with XFS","modified":"2026-08-31T02:53:24Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/litosmartin/CVE-2026-64600-Refluxfs-PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-08-31T02:53:24Z","url":"https://github.com/litosmartin/CVE-2026-64600-Refluxfs-PoC"}],"tags":[]},{"url":"https://github.com/bha-vin/CVE-2026-64600-Exploit","source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-07-28T09:42:55Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/bha-vin/CVE-2026-64600-Exploit"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-07-28T09:42:55Z","url":"https://github.com/bha-vin/CVE-2026-64600-Exploit"}],"tags":[]},{"url":"https://github.com/letsr00t/RefluxFS_CVE-2026-64600","source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-08-04T06:58:59Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/letsr00t/RefluxFS_CVE-2026-64600"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-08-04T06:58:59Z","url":"https://github.com/letsr00t/RefluxFS_CVE-2026-64600"}],"tags":[]},{"url":"https://github.com/masrikky/CVE-2026-64600-RefluXFS","source":"poc-in-github","sourceId":"CVE-2026-64600","description":"A Linux kernel local privilege escalation affecting the XFS filesystem copy-on-write (CoW) path.","modified":"2026-08-14T05:01:45Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/masrikky/CVE-2026-64600-RefluXFS"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-08-14T05:01:45Z","url":"https://github.com/masrikky/CVE-2026-64600-RefluXFS"}],"tags":[]},{"url":"https://github.com/0xSec1/CVE-2026-64600-RefluXFS-PoC","source":"poc-in-github","sourceId":"CVE-2026-64600","description":"PoC for RefluXFS","modified":"2026-08-14T12:57:38Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/0xSec1/CVE-2026-64600-RefluXFS-PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-08-14T12:57:38Z","url":"https://github.com/0xSec1/CVE-2026-64600-RefluXFS-PoC"}],"tags":[]},{"url":"https://github.com/k4ntux/COWSlip","source":"poc-in-github","sourceId":"CVE-2026-64600","description":"xfs kernel LPE (CVE-2026-64600), disclosed by Qualys on 22 July 2026","modified":"2026-09-26T16:38:10Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-64600","url":"https://github.com/k4ntux/COWSlip"},{"source":"poc-in-github","sourceId":"CVE-2026-64600","modified":"2026-09-26T16:38:10Z","url":"https://github.com/k4ntux/COWSlip"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"10Base-RHEL-Nvidia:kernel-0:6.12.0-231.17.el10nv.aarch64","product":"kernel-0:6.12.0-231.17.el10nv.aarch64 as a component of NVIDIA for RHEL 10","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHBA-2026:39321"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel@6.12.0-231.17.el10nv?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"AppStream-10.2.Z:kernel-debuginfo-common-aarch64-0:6.12.0-211.34.1.el10_2.aarch64","product":"kernel-debuginfo-common-aarch64-0:6.12.0-211.34.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:39494"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel-debuginfo-common-aarch64@6.12.0-211.34.1.el10_2?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"AppStream-9.4.0.Z.E4S:kernel-devel-0:5.14.0-427.138.1.el9_4.aarch64","product":"kernel-devel-0:5.14.0-427.138.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:41063"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel-devel@5.14.0-427.138.1.el9_4?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-687.26.1.el9_8.x86_64","product":"kernel-debuginfo-common-x86_64-0:5.14.0-687.26.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHBA-2026:39332"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel-debuginfo-common-x86_64@5.14.0-687.26.1.el9_8?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"BaseOS-10.0.Z.E2S:libperf-debuginfo-0:6.12.0-55.89.1.el10_0.aarch64","product":"libperf-debuginfo-0:6.12.0-55.89.1.el10_0.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:41062"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/libperf-debuginfo@6.12.0-55.89.1.el10_0?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-0:4.18.0-553.144.1.el8_10.aarch64","product":"kernel-debug-0:4.18.0-553.144.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:39179"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel-debug@4.18.0-553.144.1.el8_10?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"BaseOS-8.4.0.Z.EUS.EXTENSION:kernel-debug-core-0:4.18.0-305.198.1.el8_4.x86_64","product":"kernel-debug-core-0:4.18.0-305.198.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:39984"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel-debug-core@4.18.0-305.198.1.el8_4?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"BaseOS-8.8.0.Z.E4S:perf-debuginfo-0:4.18.0-477.154.1.el8_8.x86_64","product":"perf-debuginfo-0:4.18.0-477.154.1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:41229"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/perf-debuginfo@4.18.0-477.154.1.el8_8?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"BaseOS-9.2.0.Z.E4S:kpatch-patch-5_14_0-284_158_1-0:1-8.el9_2.x86_64","product":"kpatch-patch-5_14_0-284_158_1-0:1-8.el9_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:47997"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-284_158_1@1-8.el9_2?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"BaseOS-9.4.0.Z.E4S:kpatch-patch-5_14_0-427_68_2-debuginfo-0:1-18.el9_4.ppc64le","product":"kpatch-patch-5_14_0-427_68_2-debuginfo-0:1-18.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)","status":"fixed","remediations":[{"category":"vendor_fix","details":"Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:47984"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-427_68_2-debuginfo@1-18.el9_4?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-11.el9_6.ppc64le","product":"kpatch-patch-5_14_0-570_66_1-debugsource-0:1-11.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)","status":"fixed","remediations":[{"category":"vendor_fix","details":"Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:47983"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-570_66_1-debugsource@1-11.el9_6?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"CRB-10.0.Z.E2S:kernel-rt-64k-debug-debuginfo-0:6.12.0-55.89.1.el10_0.aarch64","product":"kernel-rt-64k-debug-debuginfo-0:6.12.0-55.89.1.el10_0.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:41062"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel-rt-64k-debug-debuginfo@6.12.0-55.89.1.el10_0?arch=aarch64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"CRB-9.8.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-687.26.1.el9_8.ppc64le","product":"kernel-debug-debuginfo-0:5.14.0-687.26.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHBA-2026:39332"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel-debug-debuginfo@5.14.0-687.26.1.el9_8?arch=ppc64le","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"NFV-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.128.1.el9_6.x86_64","product":"libperf-debuginfo-0:5.14.0-570.128.1.el9_6.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:40425"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/libperf-debuginfo@5.14.0-570.128.1.el9_6?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.144.1.rt7.485.el8_10.x86_64","product":"kernel-rt-debug-devel-0:4.18.0-553.144.1.rt7.485.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHSA-2026:39180"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/kernel-rt-debug-devel@4.18.0-553.144.1.rt7.485.el8_10?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"RT-9.8.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-687.26.1.el9_8.x86_64","product":"python3-perf-debuginfo-0:5.14.0-687.26.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.","url":"https://access.redhat.com/errata/RHBA-2026:39332"},{"category":"workaround","details":"This vulnerability can be mitigated using a SystemTap script. To create and apply the mitigation, follow the steps below:\n\n1. Install and configure SystemTap\n\nInstall the SystemTap package and its dependencies following the instructions at:\nhttps://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/monitoring_and_managing_system_status_and_performance/getting-started-with-systemtap\n\n2. Create the mitigation script\n\nCreate a file named `refluxfs_mitigation.stp` with the following contents:\n\n~~~\nprobe begin {\n        printf(\"refluxfs mitigation loaded\\n\")\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").call {\n        $remap_flags = 0xffff\n}\n\nprobe module(\"xfs\").function(\"xfs_file_remap_range\").return {\n        $return = -95\n}\n\nprobe end {\n        printf(\"refluxfs mitigation unloaded\\n\")\n}\n~~~\n\n3. Load the mitigation\n\nAs the `root` user, execute SystemTap in guru mode:\n\n~~~\nstap -g refluxfs_mitigation.stp\n~~~\n\nOnce the script is compiled and loaded, the following message will appear:\n\n~~~\nrefluxfs mitigation loaded\n~~~\n\nWith the mitigation active, any application attempting to use reflink to copy files will receive `-EOPNOTSUPP` (`-95`) when calling the `FICLONE` ioctl (or its variants) or the `copy_file_range()` syscall.\n\nImportant considerations:\n\n1. SystemTap scripts are compiled into kernel modules. On systems with Secure Boot enabled, the kernel is in lockdown mode and will only load modules signed with a valid Secure Boot key or a key enrolled in the MOK. SystemTap can sign the generated module at compile time, but the user is responsible for key management. For instructions, refer to the \"Sign a SystemTap module\" section of:\nhttps://www.redhat.com/en/blog/secure-boot-systemtap\n\n2. The SystemTap module is not persistent across reboots. If the machine is restarted or the `stap` process is terminated, the module will be unloaded and the mitigation must be reapplied.\n\n3. Programs that rely on CoW/reflink without a fallback mechanism may fail, as reflink operations will be unavailable on any XFS filesystem while the mitigation is loaded. This includes the `cp` command when run with `--reflink=always`. In that case, use `--reflink=auto` instead, which is the default behavior in Red Hat Enterprise Linux."}],"purl":"pkg:rpm/redhat/python3-perf-debuginfo@5.14.0-687.26.1.el9_8?arch=x86_64","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_6:kernel","product":"kernel as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_6:kernel-debug","product":"kernel-debug as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-debug","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_6:kernel-devel","product":"kernel-devel as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_6:kernel-headers","product":"kernel-headers as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-headers","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_6:kernel.src","product":"kernel.src as a component of Red Hat Enterprise Linux 6","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:bpftool","product":"bpftool as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/bpftool","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-abi-whitelists","product":"kernel-abi-whitelists as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-abi-whitelists","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-debug-devel","product":"kernel-debug-devel as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-debug-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-headers","product":"kernel-headers as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-headers","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-rt","product":"kernel-rt as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-rt","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-rt-debug-devel","product":"kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-rt-debug-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-rt-doc","product":"kernel-rt-doc as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-rt-doc","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-rt-trace-devel","product":"kernel-rt-trace-devel as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-rt-trace-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-tools","product":"kernel-tools as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-tools","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:kernel-tools-libs-devel","product":"kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/kernel-tools-libs-devel","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]},{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json","productId":"red_hat_enterprise_linux_7:python-perf","product":"python-perf as a component of Red Hat Enterprise Linux 7","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/python-perf","origins":[{"source":"redhat","sourceId":"CVE-2026-64600","modified":"2026-09-29T08:57:37+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64600.json"}]}],"vendorCoverage":{"total":2223,"shown":32,"omitted":2191,"source":"redhat"}}