CVE-2018-19489: Race Condition
Published Dec 13, 2018
·Updated
Last updated 25 August 2025
Other sources
v9fswstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
— Launchpad
Affected Software
13 affected componentsFixes available
Qemu Qemu<=3.0.0
Qemu Qemu=3.1.0-rc0
Qemu Qemu=3.1.0-rc1
Qemu Qemu=3.1.0-rc2
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Fedoraproject Fedora=29
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
openSUSE Leap=42.3
debian/qemu
1:5.2+dfsg-11+deb11u31:5.2+dfsg-11+deb11u51:7.2+dfsg-7+deb12u181:7.2+dfsg-7+deb12u151:10.0.7+ds-0+deb13u11:10.0.2+ds-2+deb13u11:10.2.1+ds-1
Remediation
Patch Available
Event History
Dec 13, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·05:44 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·05:44 PM
Description
Feb 23, 2026
Data Sourced
via Debian·04:00 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-19489?
CVE-2018-19489 is classified as a denial of service vulnerability due to a race condition in QEMU.
2
How do I fix CVE-2018-19489?
To remediate CVE-2018-19489, update QEMU to a version that is not affected by this vulnerability.
3
Which versions of QEMU are impacted by CVE-2018-19489?
CVE-2018-19489 affects various versions of QEMU up to and including 3.0.0.
4
What type of vulnerability is CVE-2018-19489?
CVE-2018-19489 is a race condition vulnerability that can lead to a denial of service.
5
Can guest OS users trigger CVE-2018-19489?
Yes, guest OS users can exploit CVE-2018-19489 to cause a crash in the host system.