CVE-2026-93834

A flaw in the software that lets a virtual machine share folders with its host may let someone inside the virtual machine reach outside the folder they were meant to use. It is like giving a tenant a key for one storage unit, but a fault lets that key open doors in the rest of the building.

This matters to you if you run affected Red Hat platforms that host virtual machines using QEMU/KVM shared folders. It is specifically a risk where the 9pfs shared-folder feature is enabled and a guest user can send requests to it.

There is no recorded public exploit code and this issue is not listed in CISA's catalog of vulnerabilities known to be actively exploited. Treat it as an amber priority because a malicious guest user may be able to break out of a virtual machine and affect its host; reduce exposure now while awaiting vendor remediation.

Confirm whether QEMU/KVM 9pfs is enabled on hosts running the affected Red Hat platforms, and identify which guest systems can access those shares. No fixed versions or supported upgrade paths have been published in the available findings, so do not assume that a routine update resolves CVE-2026-93834; obtain Red Hat's advisory before scheduling an upgrade.

If patching is delayed, disable 9pfs shared folders, remove unnecessary shared mounts, or prevent untrusted users from accessing the affected guests. Review QEMU process activity and host-file changes associated with shared directories for unexpected access or modification. CISA has not assigned a KEV due date because this CVE is not listed in KEV.

CVE-2026-93834 is rated CVSS 8.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is a CWE-416 use-after-free. The issue is a race between QEMU 9pfs Tlcreate and Twalk processing that can leave stale heap data in a fid path, enabling directory-traversal restriction bypass and potential host file read/write or code execution in the QEMU process context. No public exploit code is on record, the CVE is not in CISA KEV, and no EPSS value or trend was provided.