CVE-2026-64600: XFS race condition enables Linux local root escalation

Thu, 23 Jul 2026 12:47:45 +0000

Engineer — Act: Public PoC on GitHub makes this LPE practically weaponizable on any Linux system using XFS (common on RHEL/CentOS derivatives); patch the kernel to the version fixing CVE-2026-64600 and prioritize systems where XFS is the root or primary filesystem.
SOC/IR — Learn: Local privilege escalation via a kernel race condition offers a thin detection surface — no active campaign and no IOCs reported; note as a post-foothold escalation path attackers may chain after initial access, and revisit if exploit tooling appears in threat-actor toolkits.
Leader — Skip
Signals: CVE-2026-64600 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources

Local-Exploit on CuraSec