linux-user does not check PROT_EXEC At no point do we actually verify that a page is PROT_EXEC before translating. All we end up verifying is that the page is readable. Not the same thing, obviously. The following test case should work for any architecture, though I've only validated it for x86_64 and aarch64. It turns out we can't fix this without also fixing our implementation of signal trampolines. This is an automated cleanup. This bug report has been moved to QEMU's new bug tracker on gitlab.com and thus gets marked as 'expired' now. Please continue with the discussion here: https://gitlab.com/qemu-project/qemu/-/issues/122