The FireWire Fix Is Noise — RefluXFS Is Why You Should Reboot

If you only read one Linux kernel headline this week it was probably Phoronix noting that 7.2-rc5 fixes a longstanding bug in IPv4 over FireWire. File that under trivia. Nobody reading this blog is carrying mail over an IEEE 1394 cable, and it landed in a release candidate anyway. The actual reason to look at your kernel version this week is buried under a mountain of near-identical advisories.

Two things worth your attention

The one that should make you sit up is RefluXFS, tracked as CVE-2026-64600. BleepingComputer reported it as a flaw that lets attackers gain root, and the disclosure threads on oss-security (here and here) describe it as a local privilege escalation via an XFS reflink race. That matters to this audience specifically because XFS is a common choice for mail spools and Maildir volumes — it handles millions of small files well, which is exactly why people put Dovecot on it. This is a local-attacker bug, not something reachable from the SMTP port, but "local" includes anyone who lands a shell through a webmail exploit or a compromised service account. If your spool is XFS and you have any untrusted local access, treat this as the priority.

The second is a pair of UDP flaws, CVE-2026-53362 and CVE-2026-53366, described on oss-security as an out-of-bounds write in MSG_SPLICE_PAGES fragment-boundary handling. I only have the summary line, so I won't overstate it — but an OOB write in UDP send paths is worth watching, and it feeds into the broader "432 Linux kernel CVEs" reckoning making the rounds this quarter.

The Ubuntu wall, in perspective

Canonical pushed out a dense batch of kernel notices between 21 and 24 July — generic (USN-8575-1), a stack of Azure variants (8610-1, 8609-1, 8608-1, 8607-1, 8606-1, 8605-1, 8604-1, 8603-1), plus AWS (8595-2), GCP FIPS (8574-1), IBM (8597-1), NVIDIA Tegra (8576-1, 8576-2) and Oracle/Azure (8575-3). Debian shipped DSA-6393-1 alongside.

Here's the honest read: the named CVEs that dominate those notices are less alarming than the sheer count suggests. CVE-2023-45896 is an NTFS out-of-bounds read that requires you to mount a malicious NTFS image — not a scenario a mail server hits in normal life. CVE-2025-54505, CVE-2025-54518 and CVE-2025-62626 are AMD speculative-execution and RNG issues that need a local attacker to exploit. If your Postfix/Dovecot box has no untrusted shell users and doesn't mount attacker-supplied filesystems, these are "patch on the next cycle," not "wake up at 3am."

What to actually do Monday

Apply the kernel update through your normal package flow and reboot — none of this takes effect live. The Ubuntu notices flag an unavoidable ABI change with a new version number, so if you build third-party modules (out-of-tree NIC drivers, a DKMS-packaged filter), plan to recompile them; a standard metapackage upgrade handles that automatically only if you kept linux-generic or linux-virtual installed.

Note also that a chunk of these fixes — the IBM, GCP FIPS and older 5.15 Tegra kernels — sit behind Ubuntu Pro. If you're on those and not subscribed, the patch exists but isn't in your default archive. That's an exposure worth checking before you assume apt has you covered. And yes, 26.04 "resolute" is now getting its own Azure kernels, so if you've moved forward, confirm which series you're actually running before you patch anything.

Sources

• Phoronix — Linux 7.2-rc5 Fixing Longstanding Bug In IPv4 Networking Over Firewire
• BleepingComputer — New RefluXFS Linux flaw lets attackers gain root privileges
• oss-security — RefluXFS (CVE-2026-64600), and follow-up
• oss-security — UDP MSG_SPLICE_PAGES OOB write (CVE-2026-53362, CVE-2026-53366)
• oss-security — 432 Linux kernel CVEs
• Ubuntu Security Notices: 8610-1, 8609-1, 8608-1, 8607-1, 8606-1, 8605-1, 8604-1, 8603-1, 8597-1, 8595-2, 8576-2, 8576-1, 8575-3, 8575-1, 8574-1
• Debian — DSA-6393-1 linux