CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

Description

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Local

Attack complexity

Low

Privileges required

Low

Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected products and versions