In June 2026, the Qualys Threat Research Unit joined Anthropic’s Project Glasswing. Tasking the Claude Mythos Preview model with hunting for a Dirty COW-style race, researchers identified a vulnerability in the Linux kernel that had remained undetected for nine years. The model successfully isolated the flaw in the XFS filesystem and generated a working local privilege escalation (LPE) proof-of-concept, which Qualys subsequently verified.
The vulnerability, designated CVE-2026-64600 and dubbed RefluXFS, is a race condition within the XFS copy-on-write (reflink) path. The flaw resides in xfs_reflink_allocate_cow(). During execution, the function drops the ILOCK while awaiting transaction log space. It then re-checks the reference count using a stale physical block address. An attacker can trigger this race by initiating two concurrent O_DIRECT writes against the same reflink-shared file. This results in corruption at the filesystem allocation layer, enabling data intended for a temporary copy to be written directly into the original, protected file at the block level.
Exploitation is highly reliable. As Saeed Abbasi of Qualys noted, “Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer. Exploitation is highly reliable and leaves no kernel log output.” On a default RHEL 10.2 installation, an attacker can strip the root password from /etc/passwd to achieve passwordless root access in seconds. The attack is exceptionally stealthy: it leaves no kernel log output, persists across reboots, and preserves original file metadata, including owners, permissions, and setuid bits. Because the bug resides at the filesystem allocation layer, it bypasses standard hardening measures, including SELinux Enforcing, KASLR, SMEP, SMAP, seccomp, container isolation, and kernel lockdown.
The exposure is widespread, affecting over 16.4 million systems, including RHEL 8, 9, and 10, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, Amazon Linux 2023+, and Fedora Server 31+. Because XFS with reflink=1 is the default configuration for RHEL-family root filesystems, the attack surface is significant. Remediation is limited: there is no runtime workaround, mount option, or sysctl to disable reflink on existing volumes. The only fix is to apply a vendor kernel security update and perform a full system reboot.
This discovery is part of a broader trend in automated vulnerability research. Anthropic reported that as of May 2026, Project Glasswing participants have used Claude Mythos Preview to identify more than 10,000 high- or critical-severity security flaws. This volume of discovery, corroborated by VulnCheck, aligns with the patterns of vulnerability inflation discussed in Post 128431.
The industry is now navigating a landscape where the same AI models used for discovery also present new risks. The potential for these models to be used in ways that create new vulnerabilities is evidenced by the Anthropic evaluation breaches detailed in Post 128607. Furthermore, the role of AI providers is shifting. Anthropic was designated as a CVE Numbering Authority (CNA) on July 28, 2026, a development explored in Post 128573. This means the entities building the tools to find vulnerabilities are now also responsible for assigning the identifiers for them. This pattern is not unique to Anthropic; it is part of a broader cross-lab trend, including the development of tools like OpenAI’s ExploitGym, as noted in Post 128624. We are witnessing a transition where AI is the primary engine for both the identification of legacy code defects and the generation of new security challenges.