CVE-2026-93834: Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects QEMU deployments using the 9pfs subsystem with a shared directory accessible to a guest. A malicious user inside that guest may be able to escape the configured shared-directory boundary.
What does an attacker need to exploit it?
An attacker needs access as a user in a guest and must send concurrent Tlcreate and Twalk requests that trigger the race condition. No user interaction is described.
What is the potential impact on the host?
Successful exploitation can permit arbitrary host file reads and writes and code execution with the privileges of the QEMU process user. The issue can therefore result in VM escape.