CVE-2026-93834
Fixed in a distro release EPSS <1%CVSS 8.8
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux for NVIDIA 26, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 13 (Queens)
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | ivshmem-tools | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-audio-alsa | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-audio-oss | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-audio-pa | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-audio-sdl | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-block-curl | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-block-dmg | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-block-iscsi | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-block-nfs | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-block-rbd | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-block-ssh | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-common | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-guest-agent | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-img | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-kvm | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-kvm-core | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-system-aarch64 | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-system-aarch64-core | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-system-x86 | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-system-x86-core | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-ui-curses | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-ui-gtk | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-ui-sdl | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-user | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-user-binfmt | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2 | qemu-user-static | 10:3.1.0-8.amzn2.0.29 |
| Amazon Linux 2023 | qemu | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-common | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-docs | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-guest-agent | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-img | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-kvm | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-kvm-core | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-pr-helper | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-system-aarch64 | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-system-aarch64-core | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-system-x86 | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-system-x86-core | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-tests | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-tools | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-user | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-user-binfmt | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-user-static | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-user-static-aarch64 | 2:11.0.0-4.amzn2023 |
| Amazon Linux 2023 | qemu-user-static-x86 | 2:11.0.0-4.amzn2023 |
| Debian 12 | qemu | no fix |
| Debian 13 | qemu | no fix |
| Debian 14 | qemu | 1:11.1.2+ds-1 |
| SUSE Linux Enterprise Server 16.0 | qemu | 10.0.13-160000.2.1 |
| SUSE Linux Enterprise Server 16.0 | qemu-linux-user | 10.0.13-160000.2.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | qemu | 10.0.13-160000.2.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | qemu-linux-user | 10.0.13-160000.2.1 |
| SUSE Linux Micro 6.2 | qemu | 10.0.13-160000.2.1 |
| Ubuntu 22.04 LTS | qemu | no fix |
| Ubuntu 24.04 LTS | qemu | no fix |
| Ubuntu 26.04 LTS | qemu | no fix |
| Ubuntu 26.04 LTS | qemu-hwe | no fix |
| Ubuntu 26.10 | qemu | no fix |
| Ubuntu 26.10 | qemu-hwe | no fix |
| Ubuntu Pro 14.04 LTS | qemu | no fix |
| Ubuntu Pro 16.04 LTS | qemu | no fix |
| Ubuntu Pro 18.04 LTS | qemu | no fix |
| Ubuntu Pro 20.04 LTS | qemu | no fix |
| openSUSE Leap 16.0 | qemu | 10.0.13-160000.2.1 |
| openSUSE Leap 16.0 | qemu-linux-user | 10.0.13-160000.2.1 |
| openSUSE Tumbleweed | qemu | 11.1.1-2.1 |