Feed
QEMU

QEMU can use freed serial state if the port is hot-unplugged

Brief

We do not know whether an unprivileged guest can force that path without the host unplugging the device.

Notes

eb3f7fe382ba (Paolo Bonzini, 2026-08-20). serial: clear transmit retry callback on unrealize. Resolves work_items/4125 (issues API 404). The public commit calls it a use-after-free on hot-unplug.

Landed with f57fc2f7 Merge tag for-upstream (2026-08-20 16:01 PT).

Commit eb3f7fe382babbab44419603e81da56abb91d11a

Sources