CVE-2026-93834
8.8HighPublished 25 Sep 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416
Impact
A guest VM user can break out of the virtual machine and execute arbitrary code on the host as the QEMU process user. The attacker needs local access inside a guest VM that has a shared 9p filesystem mounted.
Root cause
A race condition between the main thread and a worker thread handling concurrent Tlcreate and Twalk requests triggers a use-after-free, letting stale heap pointers bypass 9p directory traversal checks.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade QEMU once patches are released by your vendor. If you cannot patch immediately, mitigate by disabling or removing 9p filesystem shares from guest VM configurations.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.