
Found another heap UAF race condition in QEMU (9pfs: v9fs_co_readdir_many) → DoS for unprivileged guest. CVE-2026-48004 assigned https://github.com/cschoenebeck/qemu/commit/cd9b78d326d1af5a30771d1de26dccbcf1913588 Still DoS-only for now, not sure how to chain/escalate yet. working on http://pwn.college tips nd suggestions welcome! 🙏
Post summary
A heap use‑after‑free race condition was discovered in QEMU’s 9pfs module, assigned CVE‑2026‑48004, with a GitHub commit linking to PoC code enabling DoS for unprivileged guests; no active exploitation or patch has been reported yet.

