CVE-2026-93834
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
- Published
- Sep 25, 2026
- Updated
- Nov 5, 2026
- Assigning CNA
- redhat
- Evidence observed
- Nov 4, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLow · next 30 days
- Percentile
- 34.9%
- Model date
- Nov 4, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.
Sources
- CVE-2026-93834Informational
Static Hugo tracker site recording which QEMU stable branches and Linux distributions have shipped fixes for the CVE-2026-93834 9pfs use-after-free guest-to-host escape.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.