Linux Kernel XFS Reflink Stale Data-Fork Mapping Local Privilege Escalation (RefluXFS)

#!/usr/bin/env bash
# check_cve_2026_64600.sh — Detect CVE-2026-64600 (RefluXFS) exposure
# Run on target host as any user. No root required.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

RET_VULNERABLE=1
RET_PATCHED=0
RET_UNKNOWN=2

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# --- Check for XFS with reflink=1 ---
REFLINK_ENABLED=false
XFS_MOUNTS=$(findmnt -t xfs -no TARGET 2>/dev/null || true)

if [[ -z "$XFS_MOUNTS" ]]; then
    echo "[*] No XFS filesystems mounted."
    echo "PATCHED — No XFS filesystems found. CVE-2026-64600 is not exploitable on this host."
    exit $RET_PATCHED
fi

for mp in $XFS_MOUNTS; do
    rl=$(xfs_info "$mp" 2>/dev/null | grep -o 'reflink=[0-9]' || echo "reflink=unknown")
    echo "[*] $mp: $rl"
    if [[ "$rl" == "reflink=1" ]]; then
        REFLINK_ENABLED=true
    fi
done

if [[ "$REFLINK_ENABLED" == "false" ]]; then
    echo "PATCHED — XFS mounted but reflink is not enabled. Not exploitable."
    exit $RET_PATCHED
fi

echo "[!] XFS with reflink=1 detected. Checking kernel version..."

# --- Check distro backport via package changelogs ---
if command -v rpm &>/dev/null; then
    for pkg in kernel-"$KERNEL" kernel-core-"$KERNEL"; do
        if rpm -q --changelog "$pkg" 2>/dev/null | grep -qi 'CVE-2026-64600'; then
            echo "PATCHED — $pkg changelog references CVE-2026-64600 fix."
            exit $RET_PATCHED
        fi
    done
fi

if command -v dpkg &>/dev/null; then
    cl="/usr/share/doc/linux-image-${KERNEL}/changelog.Debian.gz"
    if [[ -f "$cl" ]] && zgrep -qi 'CVE-2026-64600' "$cl" 2>/dev/null; then
        echo "PATCHED — Debian changelog references CVE-2026-64600 fix."
        exit $RET_PATCHED
    fi
fi

# --- Parse upstream kernel version ---
KVER=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "$KVER" ]]; then
    echo "UNKNOWN — Cannot parse kernel version from: $KERNEL"
    exit $RET_UNKNOWN
fi

MAJOR=$(echo "$KVER" | cut -d. -f1)
MINOR=$(echo "$KVER" | cut -d. -f2)
PATCH=$(echo "$KVER" | cut -d. -f3)
echo "[*] Parsed upstream version: $MAJOR.$MINOR.$PATCH"

# --- Version range check ---
# Fixed: 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4
# Affected: 4.11 through each branch's fix
vuln=false

if (( MAJOR < 4 )) || { (( MAJOR == 4 )) && (( MINOR < 11 )); }; then
    vuln=false
elif (( MAJOR == 4 )) && (( MINOR >= 11 )); then
    vuln=true
elif (( MAJOR == 5 )) && (( MINOR <= 14 )); then
    vuln=true
elif (( MAJOR == 5 )) && (( MINOR == 15 )); then
    (( PATCH < 212 )) && vuln=true
elif (( MAJOR == 5 )) && (( MINOR >= 16 )); then
    vuln=true
elif (( MAJOR == 6 )) && (( MINOR == 0 )); then
    vuln=true
elif (( MAJOR == 6 )) && (( MINOR == 1 )); then
    (( PATCH < 178 )) && vuln=true
elif (( MAJOR == 6 )) && (( MINOR >= 2 )) && (( MINOR <= 5 )); then
    vuln=true
elif (( MAJOR == 6 )) && (( MINOR == 6 )); then
    (( PATCH < 145 )) && vuln=true
elif (( MAJOR == 6 )) && (( MINOR >= 7 )) && (( MINOR <= 11 )); then
    vuln=true
elif (( MAJOR == 6 )) && (( MINOR == 12 )); then
    (( PATCH < 96 )) && vuln=true
elif (( MAJOR == 6 )) && (( MINOR >= 13 )) && (( MINOR <= 17 )); then
    vuln=true
elif (( MAJOR == 6 )) && (( MINOR == 18 )); then
    (( PATCH < 39 )) && vuln=true
elif (( MAJOR == 6 )) && (( MINOR >= 19 )); then
    vuln=true
elif (( MAJOR == 7 )) && (( MINOR == 0 )); then
    vuln=true
elif (( MAJOR == 7 )) && (( MINOR == 1 )); then
    (( PATCH < 4 )) && vuln=true
fi

if [[ "$vuln" == "true" ]]; then
    echo ""
    echo "==> VULNERABLE — Kernel $KERNEL is in the affected range and XFS reflink=1 is active."
    echo "    Apply vendor kernel update and reboot immediately."
    exit $RET_VULNERABLE
else
    echo ""
    echo "==> PATCHED — Kernel $KERNEL appears at or above the fixed version."
    echo "    (Distro backports may not match upstream versions. Cross-check vendor errata.)"
    exit $RET_PATCHED
fi