CVE-2026-93834

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in QEMU 9pfs Subsystem Enables VM Escape

Publication date: 2026-09-25

Last updated on: 2026-09-29

Assigner: redhat-SADP

Description

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-93834

EUVD

EUVD-2026-87092

Affected Vendors & Products

Vendor	Product	Version / Range
qemu	qemu	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in QEMU's 9pfs subsystem. A race condition between the main and worker threads during Tlcreate and Twalk requests lets a malicious guest user exploit stale heap data to bypass directory restrictions. This can lead to arbitrary file read/write and code execution on the host as the QEMU process user.

Detection Guidance

Detecting this vulnerability requires checking if QEMU instances are running with vulnerable 9pfs configurations. Inspect running QEMU processes for the presence of -fsdev or -virtfs flags. Use commands like 'ps aux | grep qemu' to list QEMU processes and examine their arguments for 9pfs-related options.

Impact Analysis

If exploited, this vulnerability allows an attacker in a guest VM to read or write arbitrary files on the host system or even execute code outside the VM. This could lead to data theft, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive host files, including those containing personal or health data. For GDPR, this may result in unauthorized data processing or disclosure, violating principles of data protection and user rights. For HIPAA, it could allow access to protected health information, leading to breaches of confidentiality and integrity requirements.

Mitigation Strategies

Update QEMU to the latest patched version immediately to address the use-after-free vulnerability in the 9pfs subsystem. Disable the 9pfs feature if not required to reduce attack surface. Monitor guest activity for unusual file access patterns or directory traversal attempts.

Hi! I’m here to help you understand CVE-2026-93834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70