suominen/cve-2026-93834Static Hugo tracker site recording which QEMU stable branches and Linux distributions have shipped fixes for the CVE-2026-93834 9pfs use-after-free guest-to-host escape.
Source for the CVE-2026-93834 patch-status tracker: a single-page site recording which QEMU stable branches and which distributions have shipped a fix for the QEMU 9pfs use-after-free guest-to-host escape.
Everything about the bug — affected and fixed versions, the upstream fix commit and its stable backports, discovery and disclosure credit, and current per-distribution patch status — belongs to the tracker page, not to this README:
site/content/_index.mdEdit that file; everything else in this repo is build infrastructure.
None of it is restated here on purpose. The tracker page is revised as distributions ship fixes — for the actively updated trackers, twice daily by the auto-update agent — so any copy kept in this README would silently rot. Resist re-adding a summary.
Deployment plan and current setup state live in
WEBSITE.md.
Requires Hugo ≥ 0.146.0 (the standard edition suffices: no Sass or image processing in this site) and Go (for Hugo Modules to fetch the PaperMod theme).
nix develop # dev shell: hugo, go, resvg + fonts, and every lookup tool
cd site
hugo server # local preview at http://localhost:1313/CVE-2026-93834/
If you use direnv, direnv allow once and the
dev shell auto-activates whenever you cd into the repo.
Install Hugo ≥ 0.146.0 and Go ≥ 1.24 yourself (CLAUDE.md § "Build
environment" has the go install recipe), then:
cd site
hugo server # http://localhost:1313/CVE-2026-93834/
make build # local build into site/public/
make dist # build, then rsync to haig:/CVE-2026-93834/
make banner # re-rasterise the social banner SVG → PNG (needs resvg + the banner fonts)
make check # run the helper-script tests
make dist runs make build first. make banner is only needed after
editing site/assets/cve-2026-93834-tracker.svg; the rendered PNG is
committed.
A row's Fixed since is the date the fix actually shipped, derived from the source that shipped it — never the day it was noticed. For the NixOS and nixpkgs channels that derivation is a script:
./scripts/nixos-first-shipped nixos-unstable <nixpkgs-commit>
It lists the channel's published releases, finds the earliest one built
from a revision containing the commit, and prints that release and its
publication date. Upstream QEMU dates come from the stable release
tags, Debian dates from the changelog or snapshot.debian.org, pkgsrc
dates from the package's git history, Proxmox dates from the
pve-qemu-kvm changelog, and Rocky dates from the mirror's upload
listing — CLAUDE.md has the recipes.
The other three helpers read the current state out of the security tracker and the local clones:
./scripts/debian-versions
./scripts/nixpkgs-versions
./scripts/pkgsrc-versions
Each prints one line per tracked row — the version, and whether a
changelog or patch names the tracked CVE (listed in
scripts/tracked-ids).
.
├── flake.nix # Nix dev environment (build, banner, publish, lookup tools)
├── .envrc # direnv hook → `use flake`
├── .gitignore
├── Makefile # `make build`, `make dist`, `make banner`, `make check`
├── LICENSE # CC BY 4.0
├── README.md # this file
├── CLAUDE.md # project instructions for Claude Code
├── WEBSITE.md # publication plan / decisions log
├── scripts/ # auto-update driver + prompt, and the lookup helpers
├── systemd/ # user-level service unit, run by the sweep
├── tests/ # tests for the lookup helpers
└── site/ # Hugo project
├── hugo.toml
├── content/
│ └── _index.md # the tracker (single page)
├── assets/css/extended/custom.css # PaperMod CSS overrides
├── assets/cve-2026-93834-tracker.svg # social-banner source (→ make banner)
├── static/cve-2026-93834-tracker.png # rendered OpenGraph banner (committed)
├── layouts/partials/ # PaperMod overrides (post_meta, extend_footer)
├── layouts/shortcodes/details.html # collapsible verification log
├── go.mod, go.sum # Hugo Modules — pulls PaperMod theme
└── … # standard Hugo skeleton
CC BY 4.0 — share and adapt with attribution.