Low Severity
CVE-2026-93834
Published: Oct 25, 2026
Tracking the QEMU CVE-2026-93834 9pfs fid-path use-after-free guest-to-host escape
# CVE-2026-93834 — QEMU 9pfs guest escape tracking site
Source for the CVE-2026-93834 patch-status tracker: a single-page site
recording which QEMU stable branches and which distributions have
shipped a fix for the QEMU 9pfs use-after-free guest-to-host escape.
## Where the facts live
Everything about the bug — affected and fixed versions, the upstream
fix commit and its stable backports, discovery and disclosure credit,
and current per-distribution patch status — belongs to the tracker
page, not to this README:
- **Rendered:** <https://kimmo.cloud/CVE-2026-93834/>
- **Source:** [`site/content/_index.md`](site/content/_index.md)
Edit that file; everything else in this repo is build infrastructure.
None of it is restated here on purpose. The tracker page is revised as
distributions ship fixes — for the actively updated trackers, twice
daily by the auto-update agent — so any copy kept in this README would
silently rot. Resist re-adding a summary.
Deployment plan and current setup state live in
[`WEBSITE.md`](WEBSITE.md).
## Local development
Requires Hugo ≥ 0.146.0 (the standard edition suffices: no Sass or image
processing in this site) and Go (for Hugo Modules to fetch the PaperMod
theme).
### With Nix (recommended)
```sh
nix develop # dev shell: hugo, go, resvg + fonts, and every lookup tool
cd site
hugo server # local preview at http://localhost:1313/CVE-2026-93834/
```
If you use [direnv](https://direnv.net/), `direnv allow` once and the
dev shell auto-activates whenever you `cd` into the repo.
### Without Nix
Install Hugo ≥ 0.146.0 and Go ≥ 1.24 yourself (`CLAUDE.md` § "Build
environment" has the `go install` recipe), then:
```sh
cd site
hugo server # http://localhost:1313/CVE-2026-93834/
```
## Build and publish
```sh
make build # local build into site/public/
make dist # build, then rsync to haig:/CVE-2026-93834/
make banner # re-rasterise the social banner SVG → PNG (needs resvg + the banner font