OESA-2026-4586: qemu security update

Q: Which environments are exposed to this issue?

The issue affects QEMU instances using the 9pfs subsystem with a shared directory exposed to the guest. A malicious user inside the guest can exploit concurrent Tlcreate and Twalk requests.

Q: What access does an attacker need to exploit the vulnerability?

The attacker needs local, low-privileged access in a guest running on the affected QEMU host. No user interaction is required, but the attacker must be able to issue the relevant 9pfs requests from the guest.

Q: What is the potential impact if exploitation succeeds?

An attacker may bypass the shared-directory boundary and read or write arbitrary host files accessible to the QEMU process user. This can also result in code execution as the QEMU process user, constituting a VM escape.

Published Oct 29, 2026

Updated

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es):

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.(CVE-2026-93834)

Affected Software

1 affected componentFixes available

openeuler/qemu<8.2.0-94.oe2403sp3

8.2.0-94.oe2403sp3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/qemu to a version that resolves this vulnerability.
Fixed in 8.2.0-94.oe2403sp3

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93834

Frequently Asked Questions

Which environments are exposed to this issue?

The issue affects QEMU instances using the 9pfs subsystem with a shared directory exposed to the guest. A malicious user inside the guest can exploit concurrent Tlcreate and Twalk requests.

What access does an attacker need to exploit the vulnerability?

The attacker needs local, low-privileged access in a guest running on the affected QEMU host. No user interaction is required, but the attacker must be able to issue the relevant 9pfs requests from the guest.

What is the potential impact if exploitation succeeds?

An attacker may bypass the shared-directory boundary and read or write arbitrary host files accessible to the QEMU process user. This can also result in code execution as the QEMU process user, constituting a VM escape.

OESA-2026-4586: qemu security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which environments are exposed to this issue?

What access does an attacker need to exploit the vulnerability?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed to this issue?

What access does an attacker need to exploit the vulnerability?

What is the potential impact if exploitation succeeds?