Source: qemu Version: 1:11.1.1+ds-1 Severity: grave Tags: security upstream Forwarded: https://gitlab.com/qemu-project/qemu/-/work_items/4491 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for qemu. CVE-2026-93834[0]: | A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A | race condition between the main thread and a worker thread when | processing concurrent Tlcreate and Twalk requests allows a malicious | guest user to craft a fid path containing stale heap data, bypassing | directory traversal restrictions and escaping the shared directory | boundary. This can lead to arbitrary host file read/write and code | execution (VM escape) as the QEMU process user. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-93834 https://www.cve.org/CVERecord?id=CVE-2026-93834 [1] https://gitlab.com/qemu-project/qemu/-/work_items/4491 [2] https://gitlab.com/qemu-project/qemu/-/commit/fe9e30899ffceef25cf345ec83f76546afca19dd Please adjust the affected versions in the BTS as needed. Regards, Salvatore
