On July 22, 2026, Qualys disclosed CVE-2026-64600 (dubbed “RefluXFS”), a Linux kernel vulnerability in the XFS filesystem’s copy-on-write handling. RefluXFS is a race condition in how XFS handles concurrent direct I/O writes to a reflinked file. Exploiting this requires only an ordinary local user account with write access to a directory on an affected XFS volume. The vulnerability affects Linux kernels since v4.11 (2017) running XFS with reflink enabled.
In response to the Qualys announcement, our engineering team began investigating potential exposure. As part of that investigation, we built a working proof-of-concept exploit and confirmed it functions against a generic vulnerable target. We then extensively tested that same proof-of-concept against CircleCI’s own build infrastructure and were unable to leverage it to compromise our systems. As of this writing, we have no evidence that this vulnerability has been exploited in any part of the CircleCI infrastructure.
Although our testing did not reproduce exploitability against our own infrastructure, out of an abundance of caution we decided not to wait for a patched kernel to become available from our Linux distribution provider. We built and validated our own kernel carrying the upstream fix for CVE-2026-64600 and have deployed it across all of the infrastructure that runs Docker jobs. That rollout finished on July 29, 2026 at 01:12 UTC. We will move to our distribution provider’s kernel through our normal update process once it is released.
Docker jobs: No Action Required
We built a proof-of-concept for CVE-2026-64600 and validated that it successfully triggers the underlying race condition against a generic target. We then ran that same proof-of-concept repeatedly against our Docker executor fleet and were unable to trigger it.
Out of an abundance of caution, we have deployed a kernel we built and validated ourselves, carrying the upstream fix, across all of the infrastructure that runs Docker jobs. No action is required on your part.
Machine executor jobs: No Action Required
Machine executor jobs already run with root access by design, so this vulnerability cannot expose data or credentials beyond the access that your build already has. Each VM is yours alone for the duration of a job and is destroyed when the job ends, so this vulnerability cannot carry over between jobs or customers. No action is required on your part.
‘Self-hosted’ Runners: Evaluate and Patch Your Host Machines
If you run CircleCI Runners on your own Linux hosts using XFS with reflink enabled, we recommend you assess your exposure and apply guidance from your Linux distribution provider as needed. CircleCI does not distribute any images for Runners, so there are no CircleCI-side updates to Runner binaries, and our testing against our own executor fleet does not speak to the configuration of your self-hosted hosts.
A note on vulnerability scanners
If you’re running a vulnerability scanner inside your job, it may still flag the running kernel as unpatched against CVE-2026-64600. Scanners generally match on package versions, and the kernel now running under Docker jobs is one we built ourselves to carry the upstream fix ahead of our distribution provider’s release, so a version match alone will not reflect that the fix is present. We expect this to clear once our distribution provider’s patched kernel is released and moves through our normal update process. In the meantime, you can reference this post to document the exception in your security tooling.
Updates
July 22, 2026 - CVE-2026-64600 (“RefluXFS”) disclosed.
July 24, 2026 - CircleCI began investigating exposure.
July 25, 2026 - We completed proof-of-concept development and testing. Our testing did not reproduce exploitability against our own infrastructure.
July 25, 2026 - Out of an abundance of caution, we began a staged rollout of a patched kernel across the infrastructure that runs Docker jobs.
July 29, 2026, 01:12 UTC - The patched kernel rollout completed across all of the infrastructure that runs Docker jobs, including both Gen1 and Gen2 Docker resource classes.