CVE-2026-63318: 
QEMU vulnerability analysis and mitigation

CVE-2026-63318 is a security bypass vulnerability in QEMU's 9p filesystem (virtio-9p/9pfs) implementation affecting the 9p2000.u protocol. A guest can open a file with the O_TRUNC flag on a read-only 9p filesystem, bypassing the server's read-only enforcement and causing host files on the read-only export to be truncated to empty. The root cause is an incorrect comparison of the read-only check against the Topen request's mode encoding rather than the already-converted flags variable. The CVE status is currently Reserved, with a CVSS category estimated as HIGH by Feedly (Feedly, QEMU Commit).

The vulnerability is rooted in a logic error (CWE-284: Improper Access Control) in QEMU's 9p server implementation. When a guest issues a Topen request using the 9p2000.u protocol with the O_TRUNC flag, the server's read-only enforcement code incorrectly compares the raw mode field from the protocol request rather than the already-converted flags variable, causing the read-only check to be bypassed. This allows the guest to truncate files on a host filesystem that was exported as read-only via the 9p server. A fix has been committed to the QEMU upstream repository (QEMU Commit).

Successful exploitation allows a malicious or compromised guest VM to truncate (zero out) arbitrary files on the host's read-only 9p export, resulting in permanent data loss or corruption on the host filesystem. This breaks the integrity and availability guarantees of the read-only export, potentially affecting host system stability, shared data, or configuration files. Confidentiality is not directly impacted, but the ability to corrupt host files from a guest context represents a significant guest-to-host boundary violation (Feedly, QEMU Commit).

No public exploit code or in-the-wild exploitation has been reported at this time. The CVE remains in Reserved status as of the latest available data. Exploitation requires the attacker to control or compromise a guest VM that has access to a 9p filesystem exported by the host using the 9p2000.u protocol. A Tenable Nessus plugin (ID 335360) has been published to detect affected systems (Tenable, Feedly).

1. Precondition: Attacker controls a guest VM with access to a QEMU virtio-9p filesystem mount that the host has configured as read-only using the 9p2000.u protocol.
2. Identify target files: From within the guest, enumerate files accessible via the 9p mount point (e.g., ls /mnt/9p-share/).
3. Craft malicious open request: Issue a file open request using the 9p2000.u protocol with the O_TRUNC flag set against a target file on the read-only export (e.g., using a custom 9p client or by manipulating the kernel's 9p client to send a Topen with O_TRUNC).
4. Bypass read-only check: Due to the incorrect comparison of the raw mode field instead of the converted flags variable, the QEMU 9p server fails to reject the truncation request.
5. File truncated on host: The target file on the host's read-only export is truncated to zero bytes, causing data loss or corruption on the host filesystem (QEMU Commit).

• File System: Host files on 9p read-only exports unexpectedly truncated to zero bytes; timestamps on host files updated without corresponding write activity from authorized processes.
• Logs: QEMU process logs showing Topen requests with O_TRUNC flag against read-only 9p exports; unexpected file modification events on host directories used as 9p exports (detectable via inotifywait or auditd).
• Process: Unusual 9p client activity within guest VMs, particularly custom or non-standard 9p clients issuing open requests with truncation flags on read-only mounts.

Apply the upstream QEMU patch that corrects the read-only check to compare against the converted flags variable rather than the raw mode field (QEMU Commit). As a workaround, administrators can avoid exposing host filesystems to untrusted guests via 9p, or switch to a different transport/protocol that does not exhibit this issue. Monitor vendor distributions (e.g., Red Hat, Debian, Ubuntu) for backported patches and apply them promptly. Use Tenable Nessus plugin 335360 to identify affected QEMU deployments (Tenable).