OESA-2026-4587: qemu security update

Q: Which QEMU deployments are exposed to this issue?

Deployments using QEMU's 9pfs subsystem with a shared directory are exposed. The issue is triggered from a malicious guest user processing concurrent Tlcreate and Twalk requests.

Q: What access does an attacker need to exploit it?

The attacker needs access as a user inside the guest and must be able to send concurrent 9pfs Tlcreate and Twalk requests. No user interaction is described as necessary.

Q: What could an attacker gain after successful exploitation?

An attacker may bypass the shared-directory boundary and obtain arbitrary host file read and write access. This can also result in code execution as the user running the QEMU process, constituting a VM escape.

Published Oct 29, 2026

Updated

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es):

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.(CVE-2026-93834)

Affected Software

1 affected componentFixes available

openeuler/qemu<8.2.0-90.oe2403sp4

8.2.0-90.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/qemu to a version that resolves this vulnerability.
Fixed in 8.2.0-90.oe2403sp4

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-93834

Frequently Asked Questions

Which QEMU deployments are exposed to this issue?

Deployments using QEMU's 9pfs subsystem with a shared directory are exposed. The issue is triggered from a malicious guest user processing concurrent Tlcreate and Twalk requests.

What access does an attacker need to exploit it?

The attacker needs access as a user inside the guest and must be able to send concurrent 9pfs Tlcreate and Twalk requests. No user interaction is described as necessary.

What could an attacker gain after successful exploitation?

An attacker may bypass the shared-directory boundary and obtain arbitrary host file read and write access. This can also result in code execution as the user running the QEMU process, constituting a VM escape.

OESA-2026-4587: qemu security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which QEMU deployments are exposed to this issue?

What access does an attacker need to exploit it?

What could an attacker gain after successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which QEMU deployments are exposed to this issue?

What access does an attacker need to exploit it?

What could an attacker gain after successful exploitation?