CVE-2026-93834

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

No known exploitation. No EPSS score yet. Only a workaround so far.

CVSS 3.18.8High EPSS percentile—No score yet CISA KEVNot listedNo confirmed exploitation
No public exploit known FixWorkaroundNo fixed build yet

Published 2026-09-25Updated 2026-09-25Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Steps

Written by AI from the record

Check whether you run Red Hat virtual machines with shared folders enabled through QEMU/KVM 9pfs.
Identify every affected Red Hat platform and restrict untrusted users from those guest systems while you assess exposure.
No fixed version or vendor patch information is currently available; contact Red Hat for the supported remediation and deploy it when released.
If you cannot patch yet, disable 9pfs shared folders or remove access to the affected virtual machines where practical.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

In plain language

Written by AI from the record

This is a serious flaw in virtual-machine hosting on affected Red Hat platforms; small businesses should act if they run guest virtual machines using shared folders.

A guest user with access to QEMU/KVM 9pfs can trigger a use-after-free race between Tlcreate and Twalk requests, bypass shared-directory traversal restrictions, and potentially escape the VM as the QEMU process user.

If you're affected

Host file access
Host file modification
Virtual machine escape
Service disruption
Potential code execution

What is it

A flaw in the software that lets a virtual machine share folders with its host may let someone inside the virtual machine reach outside the folder they were meant to use. It is like giving a tenant a key for one storage unit, but a fault lets that key open doors in the rest of the building.

Who is affected

This matters to you if you run affected Red Hat platforms that host virtual machines using QEMU/KVM shared folders. It is specifically a risk where the 9pfs shared-folder feature is enabled and a guest user can send requests to it.

How urgent is it

There is no recorded public exploit code and this issue is not listed in CISA's catalog of vulnerabilities known to be actively exploited. Treat it as an amber priority because a malicious guest user may be able to break out of a virtual machine and affect its host; reduce exposure now while awaiting vendor remediation.

What to do — in detail

Confirm whether QEMU/KVM 9pfs is enabled on hosts running the affected Red Hat platforms, and identify which guest systems can access those shares. No fixed versions or supported upgrade paths have been published in the available findings, so do not assume that a routine update resolves CVE-2026-93834; obtain Red Hat's advisory before scheduling an upgrade.

If patching is delayed, disable 9pfs shared folders, remove unnecessary shared mounts, or prevent untrusted users from accessing the affected guests. Review QEMU process activity and host-file changes associated with shared directories for unexpected access or modification. CISA has not assigned a KEV due date because this CVE is not listed in KEV.

Technical context

CVE-2026-93834 is rated CVSS 8.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is a CWE-416 use-after-free. The issue is a race between QEMU 9pfs Tlcreate and Twalk processing that can leave stale heap data in a fid path, enabling directory-traversal restriction bypass and potential host file read/write or code execution in the QEMU process context. No public exploit code is on record, the CVE is not in CISA KEV, and no EPSS value or trend was provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV: Not in the catalog. CISA has not confirmed exploitation.
Public exploits: No public exploit or proof of concept found in the sources we track.
EPSS: No EPSS score yet. New CVEs are usually scored within a few days.

Lifecycle

5 events over 0 days, from the signal feeds we watch.

2026-09-25Workaround availablepublished, weakness classified, att&ck mapped, record updated

Affected products

Red Hatcommercial · US

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable