CVE-2026-93834

EUVD-2026-87092
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.01%
Debian logo
Debian Releases
Debian Product
Codename
qemu
bookworm
vulnerable
bookworm (security)
vulnerable
forky
1:11.1.2+ds-3
fixed
sid
1:11.1.3+ds-1
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qemu
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
qemu-hwe
jammy
dne
noble
dne
resolute
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ivshmem-tools
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-audio-alsa
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-audio-oss
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-audio-pa
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-audio-sdl
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-block-curl
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-block-dmg
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-block-iscsi
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-block-nfs
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-block-rbd
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-block-ssh
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-common
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-common-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-debuginfo
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-debugsource
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-docs
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-guest-agent
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-guest-agent-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-img
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-img-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-kvm
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-kvm-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-pr-helper
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-pr-helper-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-aarch64
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-aarch64-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-aarch64-core-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-x86
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-x86-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-x86-core-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-tests
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-tests-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-tools
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-tools-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-ui-curses
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-ui-gtk
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-ui-sdl
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
qemu-user
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-binfmt
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static
Amazon Linux 2
10:3.1.0-8.amzn2.0.29
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static-aarch64
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static-aarch64-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static-x86
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static-x86-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
qemu
Azure Linux 3.0
0:10.1.0-2.azl3
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-93834
https://bugzilla.redhat.com/show_bug.cgi?id=2537939
https://gitlab.com/qemu-project/qemu/-/work_items/4491
https://gitlab.com/qemu-project/qemu/-/work_items/4491