Researchers disclose RefluXFS race condition in Linux XFS enabling root access

Decade-old XFS race condition enables local privilege escalation

A race condition that has reportedly lingered in the Linux XFS filesystem code for roughly nine to ten years can be exploited by a local, unprivileged user to gain full root access, according to multiple security outlets. Network World reports the flaw resides in the XFS file system and effectively hands full administrative control of a machine to a local account on a default install. BleepingComputer and The Hacker News attribute the issue to the same XFS component and identify the vulnerability under the name RefluXFS, describing it as a long-standing local privilege escalation bug rather than a remote network exploit.

Default RHEL setups identified as exposed

The Hacker News reports that the race condition is reliably exploitable on default Red Hat Enterprise Linux installations with default settings, allowing a local user without administrative rights to elevate to root. BleepingComputer frames the bug as a long-known flaw that has been newly publicized after years in the kernel, while Network World notes that the extent of patching and mitigations across mainstream enterprise Linux distributions remains a focus of the disclosure. Reporting across the three outlets agrees that the trigger is local rather than remote, narrowing the immediate attack profile to attackers who already have an account or foothold on the host.

Steam Machine hardware running SteamOS attracts early Linux gaming attention

Outside of the security disclosures, GamingOnLinux published initial impressions of the Steam Machine, a compact Valve-built device built around the SteamOS Linux operating system. The piece frames the hardware as a Linux-first gaming console and discusses how SteamOS integrates with Valve's existing software and store ecosystem. The early-look coverage positions the Steam Machine as a continuation of Valve's push to bring PC gaming to a console-style form factor on Linux rather than a separate introduction of Linux gaming to mainstream audiences.