Description

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-25T14:17:24.063Z",
  "pubdate": "2026-09-25T14:17:24.063Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the QEMU 9pfs subsystem, stemming from a race condition during the concurrent processing of Tlcreate and Twalk requests. This flaw impacts the 9pfs file system passthrough implementation, potentially allowing a malicious guest user to escape the designated shared directory boundary.\nThe vulnerability occurs due to improper synchronization between the main thread and worker threads, leading to a race condition where stale heap data is manipulated within a fid path. By exploiting this state, an attacker can bypass directory traversal restrictions enforced by the hypervisor. Successful exploitation allows a guest user to achieve arbitrary read/write access to host files and potentially execute code in the context of the QEMU process on the host system.\nThis represents a significant VM escape vector, undermining the isolation boundary between the guest operating system and the host. The risk is considered high, as it requires only the ability to interact with the 9pfs interface from within a guest machine. No specific authentication is required beyond standard guest access, making it a potent threat for multi-tenant environments relying on 9pfs for guest-host resource sharing.",
  "technicalDetails": "The root cause of this vulnerability lies in the memory management lifecycle of the 9pfs fid structure within QEMU. The 9pfs subsystem handles file system requests asynchronously, utilizing worker threads to perform I/O operations. When concurrent Tlcreate (create file) and Twalk (walk directory tree) requests are issued, the internal fid object associated with the current path can become subject to a race condition.\nThe vulnerability is triggered when a Twalk request attempts to traverse a path while a concurrent Tlcreate request is modifying the underlying fid structure. If the worker thread managing the Tlcreate request frees or reallocates the fid object while the main thread or another worker thread is still utilizing it for a Twalk operation, a use-after-free condition is materialized. The attacker provides a crafted fid path that forces the subsystem to reference memory that has already been deallocated but not yet zeroed out.\nExploitation proceeds through the manipulation of the guest's 9pfs request stream. By timing the Tlcreate and Twalk requests precisely, the attacker influences the heap layout to ensure that the stale fid pointer references attacker-controlled data. This stale pointer is subsequently used by the 9pfs backend to resolve file paths. Because the directory traversal check relies on the integrity of the fid's path components, the use of stale heap data allows the attacker to bypass the '..' (parent directory) restrictions, effectively enabling path traversal outside the exported 9p root directory.\nThe post-exploitation impact is severe. Once path traversal is achieved, the attacker can access arbitrary host files accessible to the user running the QEMU process. By targeting specific configuration files, device nodes, or executable binaries on the host, the attacker can escalate privileges or achieve arbitrary code execution. Since the QEMU process acts as a gateway to the host, compromising this component typically grants the attacker the same permission levels as the QEMU host process, leading to a complete VM escape and full compromise of the affected guest instance's host resources."
}