Linux XFS privilege escalation, BIND and Unbound DNS flaws, and Exim local bugs land together

Security researchers and maintainers published a dense set of fixes and advisories covering a local root path in the Linux kernel, large batches of DNS resolver bugs in BIND 9 and Unbound, and privilege issues in Exim.

The most severe item is RefluXFS (CVE-2026-64600), a local privilege escalation in the kernel XFS filesystem. Qualys reported a race in the reflink copy-on-write path that lets an unprivileged user overwrite the on-disk contents of any file they can read on an XFS volume created with reflink support, the mkfs default since 2019. An attacker clones a target such as a SUID binary or /etc/passwd into a scratch file they own, then races concurrent direct I/O writes so one write lands in the original file. Qualys said the bug was found with iterative prompting of an Anthropic model aimed at race conditions in core filesystem code, then confirmed with a working root proof of concept on a default Fedora Server install.

On the DNS side, ISC disclosed nine BIND 9 vulnerabilities and shipped fixed builds in the 9.20 and 9.21 branches. The set includes cache poisoning via label-count and RRSIG wildcard handling (CVE-2026-11721), a DNSSEC validation bypass through an out-of-zone NSEC next field (CVE-2026-13321), incorrect acceptance of NSEC3 records, RPZ policy bypass risk, and several paths to unexpected exit or memory use beyond configured limits. Operators are expected to upgrade promptly where DNSSEC validation or response policy zones are in use.

NLnet Labs released Unbound 1.25.2 as a security update addressing a long list of flaws, four rated high. High-severity items include a remote DNS-over-QUIC denial of service from a quic-size budget bypass (CVE-2026-32665), a packet-of-death for DNSCrypt over TCP (CVE-2026-40691), cross-zone wildcard cache poisoning via RRSIG.labels manipulation (CVE-2026-44690), and a stack buffer overflow when dns-error-reporting is enabled (CVE-2026-55973). Medium issues span further DoQ assertion failures, cache and quota logic errors, possible use-after-free on DoT forwarder paths, RPZ and response-ip rewriting of BOGUS answers, and other crash or poisoning risks.

Exim 4.99.5 fixes two local problems. One is a directory traversal through queue-name command-line handoff that can reach files outside the spool and escalate privilege; it affects releases from 4.88 onward. The second allows a local user with a .forward file, under configurations that combine a redirect router, a privileged pipe transport, and force_command, to achieve command execution at elevated privilege. There are no meaningful mitigations short of the upgrade.

Taken together the batch hits core infrastructure: host kernels with XFS, widely deployed authoritative and recursive DNS, and a common MTA. Priority order for most sites is the kernel race where untrusted local users exist, then resolver upgrades, then Exim.