CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

This vulnerability is rated as Important because, although a successful escape from the virtual machine to the host process compromises hypervisor isolation boundaries, exploitation strictly requires an active 9pfs shared filesystem configured for the guest. Virtual machines operating under default Red Hat Enterprise Linux virtualization configurations do not enable 9p file sharing devices and are consequently unexposed. For deployments where 9pfs is explicitly attached, an authenticated guest user can leverage the race condition within concurrent file operations to escape the guest sandbox and gain the host-level permissions of the QEMU worker process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not configure 9pfs/VirtFS filesystem sharing (-fsdev, -virtfs) on affected QEMU instances. If host-guest file sharing is required, use virtio-fs (virtiofsd) as an alternative, which does not use the vulnerable 9pfs code path.