RUSTSEC-2024-0428: Undefined behaviour in `kvm_ioctls::ioctls::vm::VmFd::create_device`

What to do

1. See which version you have: cargo tree -i kvm-ioctls (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p kvm-ioctls. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example kvm-ioctls = "0.19.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

An issue was identified in the VmFd::create_device function, leading to undefined behavior and miscompilations on rustc 1.82.0 and newer due to the function's violation of Rust's pointer safety rules.

The function downcasted a mutable reference to its struct kvm_create_device argument to an immutable pointer, and then proceeded to pass this pointer to a mutating system call. Rustc 1.82.0 and newer elides subsequent reads of this structure's fields, meaning code will not see the value written by the kernel into the fd member. Instead, the code will observe the value that this field was initialized to prior to calling VmFd::create_device (usually, 0).

The issue started in kvm-ioctls 0.1.0 and was fixed in 0.19.1 by correctly using a mutable pointer.

References

• Package: crates.io/crates/kvm-ioctls
• Advisory: rustsec.org/advisories/RUSTSEC-2024-0428.html
• Web: github.com/rust-vmm/kvm/pull/298

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.