hacKicker

QEMU · 9pfs

QEMU device emulation: heap use-after-free

Identifier CVE-2026-48004

Disclosed

Merged

Credit Warisjeet Singh

A race between directory reads and rename operations in QEMU's 9pfs device can free path state while it is still in use. An unprivileged guest can trigger the heap use-after-free and crash the host process, causing denial of service.

Exhibit 01The evidence: hw/9pfs/codir.c, verbatim
qemu / hw/9pfs/codir.c · commit 5a8da7emerged 2026-06-01
@@ -220,13 +220,16 @@ int coroutine_fn v9fs_co_readdir_many(
     int err = 0;
+    V9fsState *s = pdu->s;

     if (v9fs_request_cancelled(pdu)) {
         return -EINTR;
     }
+    v9fs_path_read_lock(s);
     v9fs_co_run_in_worker({
         err = do_readdir_many(pdu, fidp, entries, offset, maxsize, dostat);
     });
+    v9fs_path_unlock(s);
     return err;
 }