QEMU device emulation: heap use-after-free
CVE-2026-48004
Public research by Warisjeet Singh sin99xx
Disclosed
The public finding
What was found.
A race between directory reads and rename operations in QEMU's 9pfs device can free path state while it is still in use. An unprivileged guest can trigger the heap use-after-free and crash the host process, causing denial of service.
Sources and evidence.
The evidence: hw/9pfs/codir.c, verbatim
qemu / hw/9pfs/codir.c · commit 5a8da7e
merged 2026-06-01
@@ -220,13 +220,16 @@ int coroutine_fn v9fs_co_readdir_many( int err = 0; + V9fsState *s = pdu->s; if (v9fs_request_cancelled(pdu)) { return -EINTR; } + v9fs_path_read_lock(s); v9fs_co_run_in_worker({ err = do_readdir_many(pdu, fidp, entries, offset, maxsize, dostat); }); + v9fs_path_unlock(s); return err; }