What happened
Security firm Qualys disclosed CVE-2026-64600, dubbed RefluXFS, a Linux kernel vulnerability that has existed undetected for roughly nine years and was made public on July 22. The flaw allows an unprivileged local user to overwrite root-owned files on XFS filesystems, ultimately achieving persistent root-level access. Default configurations of Red Hat Enterprise Linux and its downstream derivatives, Fedora Server, and Amazon Linux were all identified as potentially exploitable, and Qualys produced a working demonstration of the attack. Separately, LG Electronics USA announced it will suspend webOS applications found to be enrolling smart televisions as always-on residential proxy nodes — a practice researchers discovered affects more than 42 percent of apps available in LG's app store, meaning a significant share of consumer and enterprise LG TVs may have been quietly routing third-party internet traffic without owner knowledge.
Why it matters for your business
The RefluXFS vulnerability is particularly dangerous in multi-tenant or shared-infrastructure environments — cloud VMs, container hosts, and developer workstations running RHEL-family operating systems — where a low-privileged user or compromised service account could escalate to full system control. Operations and security teams should audit which hosts run XFS partitions on affected distributions and prioritize patching or applying vendor mitigations immediately. The LG proxy issue presents a subtler but serious risk: organizations with smart TVs in conference rooms, lobbies, or executive suites may unknowingly be operating as nodes in third-party proxy networks, potentially exposing internal network traffic patterns or violating acceptable-use policies. Practical takeaway: treat smart TVs as unmanaged endpoints and isolate them on separate network segments until LG's app enforcement is confirmed complete.
What to watch next
Red Hat, Amazon, and the Fedora Project are expected to release formal patches and updated security advisories; administrators should monitor vendor channels closely for kernel update packages addressing CVE-2026-64600. On the smart TV front, it remains to be seen whether LG's enforcement action extends to its international app stores and whether other smart TV platforms face similar scrutiny from researchers or regulators. Broader legislative interest in IoT device security standards could accelerate if the residential proxy abuse pattern proves widespread across multiple manufacturers.