Qualys Says Claude Mythos Preview Helped Find CVE-2026-64600 in Linux XFS

On July 22, 2026, Qualys disclosed CVE-2026-64600, a race condition in XFS, a Linux filesystem. The flaw is in XFS's copy-on-write path, where the filesystem writes shared data into a new block before changing it. Qualys says it found the flaw through a manual audit workflow that included Claude Mythos Preview. Linux and security practitioners have a concrete patching question: on a qualifying system, an ordinary local account can gain host root, the highest privilege on the machine.

Qualys describes the issue as strictly local, not a network-facing flaw. Its disclosure and technical advisory say fixed kernels are available. The same material gives a useful boundary for the AI claim: the model produced a lead and a proof of concept, but researchers had to establish the security finding before it could be disclosed.

The XFS configuration that creates exposure

The advisory says a system is affected only when several conditions line up. It needs an unpatched Linux kernel from v4.11 or later, an XFS filesystem with reflink=1, and both a protected target and a directory writable by an unprivileged local user on that filesystem. Here, reflink=1 means copy-on-write file cloning enabled: files can initially share disk blocks rather than duplicating the data.

Qualys says the race lets a local attacker arrange writes through a reflinked file so that a write reaches a readable target file's underlying block. The details matter because the affected configuration is narrower than Linux in general. Debian, Ubuntu, SUSE, and Fedora Workstation do not use XFS for their root filesystem by default, according to the advisory, although an installation that selects XFS with reflink enabled can still meet the prerequisites.

For administrators, the practical response comes from the distribution's advisory, not from a generic package version. Qualys recommends applying the relevant kernel update and rebooting. Checking the running kernel and whether XFS filesystems have reflink=1 is a sensible way to determine whether the disclosed prerequisites warrant urgent patch work.

Qualys's validation steps after the model lead

Qualys says it integrated Claude Mythos Preview into a manual audit workflow and refined its prompts toward Linux kernel race conditions. It says the model identified the XFS race and generated a proof of concept, a working demonstration of the reported flaw.

That output was not the advisory. Qualys says its researchers reviewed the model's reasoning, reproduced the exploit, independently verified every technical claim, and coordinated disclosure with kernel maintainers. The technical advisory records that the patch entered the Linux kernel source tree on July 16, 2026, before the coordinated release on July 22.

What I'm building

Delegate tasks. Get software.

Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.

Take a look at vroni.com