A race condition vulnerability in the Linux kernel's XFS filesystem allows local attackers to overwrite protected files and gain root privileges. The flaw, tracked as CVE-2026-64600, has remained unpatched for nine years.
The vulnerability exists in how XFS handles file operations, creating a window where attackers can manipulate protected system files during concurrent access attempts. By exploiting this race condition, an attacker with local access can escalate privileges to root level, gaining complete system control.
The flaw affects multiple Linux distributions using XFS as the default or optional filesystem. XFS is commonly deployed in enterprise environments and data center deployments due to its performance characteristics with large files and storage systems.
Kernel developers have released patches addressing CVE-2026-64600. System administrators should prioritize updating affected systems, particularly those exposed to untrusted local users. The vulnerability requires local access to exploit, limiting risk for systems with restricted user access policies.
This discovery highlights the importance of ongoing security audits in kernel filesystems, even for components considered mature and stable.
Intensified enforcement against online scam operations in Cambodia is displacing criminal networks to Sri Lanka, where authorities have arrested over 1,000 people in 2026.
Offensive cybersecurity researchers report that safety guardrails from OpenAI and Anthropic are restricting their ability to find vulnerabilities and develop security tools. The limitations are creating friction for legitimate security work.
European drug traffickers are leveraging AI-boosted chemical synthesis to create designer drug precursors that circumvent existing product blacklists, according to an EU agency warning.
Domain registrar Namecheap handed over a customer's account to an unverified third party after a password reset request, raising security concerns for a 13-year customer.