QEMU plugs guest use-after-free in xHCI USB controller

QEMU has fixed CVE-2026-17588, a heap use-after-free in the emulated xHCI USB host controller that a guest could trigger without host cooperation.

The flaw sat in timer-driven event processing that ran outside MMIO handler context, so the device reentrancy guard was not active. A guest could aim the event ring at the controller's doorbell registers. A DMA write delivering a completion event then hit doorbell 0, reentered command processing, and ran a disable-slot path that freed endpoint and transfer objects while the outer stack still held them.

The practical risk is guest-to-host memory corruption in virtual machines that expose xHCI. Thomas Huth's fix engages the existing memory reentrancy guard around those timer paths, matching protection already used for EHCI, DWC2, and UHCI. With the guard set, the memory layer blocks DMA writes that would dispatch back into the same device's MMIO handlers.

The issue was reported by researchers at Tencent Xuanwu Lab and separately by Ken Hsu and Royce Lu of Palo Alto Networks.