What happened
A high-severity vulnerability has been identified in the QEMU’s 9pfs subsystem, designated as CVE-2026-93834. The flaw involves a use-after-free condition caused by a race between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests. An exploit can be crafted whereby a malicious guest user manipulates a fid path containing stale heap data, enabling them to bypass directory traversal restrictions and escape the shared directory boundary. This can result in arbitrary host file read/write operations and potential code execution, leading to a VM escape scenario. The vulnerability’s effects are significant, as it may allow malicious actors with local access to compromise the host system.
Who is affected
Organisations running affected deployments are those utilizing Red Hat Enterprise Linux 8, 9, and 10, Red Hat Enterprise Linux for NVIDIA 26, and Red Hat OpenShift Container Platform 4, where these versions include the vulnerable QEMU components. The vulnerability requires local access with low privileges, and it does not depend on user interaction, meaning that an attacker must already have access to the system to exploit this flaw. It is applicable to environments where the compromised QEMU subsystem processes guest requests concurrently, and the attacker has sufficient access to craft malicious requests or control the host environment.
Recommended actions
- Implement strict privilege hygiene to minimise the risk of unauthorised local access.
- Monitor for unusual activity or indicators of exploitation on systems running affected versions.
- Restrict access to the host environment to trusted administrators only.
- Review and improve endpoint security controls to detect and prevent malicious request processing.
