CVE-2026-64600: Patch Your Homelab XFS Before This LPE

Another Tuesday, another kernel bug that gives local users root. This time, it’s CVE-2026-64600, nicknamed “RefluxFS” by the Qualys researchers who found it. This one hits close to home for many of us because it targets XFS, the high-performance filesystem that underpins a huge number of homelab setups.

If you’re running Proxmox, CentOS, Rocky Linux, or even Unraid, you’re probably using XFS somewhere. This isn’t some obscure corner of the kernel. It’s a use-after-free vulnerability in the XFS metadata handling code. In simple terms, an unprivileged user with shell access can craft a sequence of filesystem operations that confuses the kernel, allowing them to overwrite kernel memory and run code as root.

This isn’t a remote code execution bug, so don’t panic just yet. An attacker needs to get on your box first. But in any realistic attack chain, gaining initial access is just step one. Escalating to root is step two, and RefluxFS makes that second step trivial on a vulnerable system. Let’s get our labs patched.

Step 1: Check Your Exposure

First, find out if you’re actually vulnerable. This is a two-part check: are you using XFS, and is your kernel old enough to have the bug?

You can run this simple script to check both at once. It identifies XFS mounts and prints your running kernel version.

#!/bin/bash

echo "--- Checking for XFS Filesystems ---"
xfs_mounts=$(lsblk -f | grep xfs)
if [ -n "$xfs_mounts" ]; then
  echo "XFS filesystems found:"
  echo "$xfs_mounts"
else
  echo "No active XFS filesystems found."
fi

echo ""
echo "--- Checking Kernel Version ---"
kernel_version=$(uname -r)
echo "Running kernel: $kernel_version"

echo ""
echo "--- Vulnerable Kernel Ranges ---"
echo "Check if your version is OLDER than these patched versions:"
echo "- 5.10.225"
echo "- 5.15.163"
echo "- 6.1.101"
echo "- 6.6.41"
echo "- 6.9.10"
echo "Distro backports may have different versioning. Check your distro's security advisory for CVE-2026-64600."

Save that as check_xfs_vuln.sh, make it executable with chmod +x check_xfs_vuln.sh, and run it.

If you see XFS filesystems listed and your kernel version is lower than the patched versions for its series, you need to update. For example, if you’re running 6.1.70, you’re vulnerable. If you’re running 6.1.102, you’re patched.

My Proxmox cluster nodes all came back positive. Proxmox uses an XFS-formatted partition on its boot drives, even when the primary storage is ZFS. It’s a sneaky dependency you might not even realize you have.

Step 2: Patch Your Kernel (and Reboot!)

Patching is straightforward. It just involves running your system’s package manager to pull down the latest kernel and its related packages. The real gotcha here isn’t the command, it’s the required reboot.

A kernel update does nothing until you reboot into it. The old, vulnerable kernel remains loaded in memory until you cycle the power. Don’t be the person who runs apt upgrade and thinks the job is done.

For Debian and Ubuntu Systems

This covers Proxmox VE, TurnKey Linux, and vanilla Debian/Ubuntu server installs.

sudo apt update
sudo apt full-upgrade -y

I use full-upgrade instead of just upgrade because it handles new dependencies and kernel package name changes more gracefully. It’s the right tool for this job. After it finishes, reboot immediately.

sudo reboot

For RHEL, CentOS, Rocky, and AlmaLinux

These distributions are big users of XFS, often as the default filesystem for the root partition. The command is just as simple.

sudo dnf update -y
# Or if you're on an older system:
# sudo yum update -y

This will pull down the latest kernel package from the repositories. Once it’s done, reboot.

sudo reboot

For Arch Linux

If you run Arch on a server, you probably update frequently anyway. The fix is already in the main repositories.

sudo pacman -Syu

As always, reboot after a kernel update.

sudo reboot

Step 3: Verify the Fix

After your server comes back online, SSH back in and verify that you’re running the new kernel.

uname -r

The output should now show a version number that is equal to or higher than the patched versions listed in the script from Step 1. For my Proxmox node, the kernel went from 6.8.4-3-pve to 6.8.4-6-pve, which contained the backported fix from upstream. Your exact version will depend on your distribution’s packaging. The key is to confirm it changed and then cross-reference your distro’s security notice for CVE-2026-64600 to be certain.

Mitigation: When You Can’t Patch Right Now

I get it. Sometimes you have a service that can’t be rebooted on a moment’s notice, or you’re waiting for a vendor (like a NAS provider) to release their specific patched firmware. If you’re stuck, you have a couple of temporary options. These are stopgaps, not solutions.

The exploit requires writing malicious metadata to an XFS filesystem. If you can prevent that, you can break the exploit chain.

If the vulnerable XFS partition is for data (not your root / filesystem), you can remount it as read-only.

# First, find the mount point
df -T | grep xfs

# Then, remount it read-only
# Replace /data/media with your actual mount point
sudo mount -o remount,ro /data/media

This will prevent any write operations, stopping the attack cold. Of course, it also prevents you from writing legitimate data, so its usefulness is limited.

This mitigation is useless if your root filesystem is XFS, as the OS can’t function in read-only mode. In that case, your only real mitigation is to double down on firewall rules and access control to prevent an attacker from getting that initial shell in the first place. But your top priority must be to schedule a maintenance window to patch and reboot.

Don’t let your homelab become a liability. This is an easy fix for a serious bug. It took me less than 15 minutes to patch and reboot my entire cluster. Get it done.

What’s Next

Once your systems are patched, it’s a good time to review your overall security posture. A single vulnerability is rarely the whole story.

• Tighten up your server’s defenses with our Ultimate Proxmox Hardening Guide.
• Prevent future patching fire drills by configuring Unattended Upgrades for Your Linux Servers.
• Apply the same security principles to your cloud infrastructure by Securing EC2 Instances From the Ground Up.