Bug 2537958

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A use-after-free race condition was found in QEMU's 9pfs (virtfs) subsystem. When processing a Tlcreate request, v9fs_co_open2() frees and replaces fidp->path on a worker thread. If a concurrent Twalk on the main thread reads the old path length before the free and copies bytes after the memory is reused, the resulting fid path contains stale heap data that bypasses the share directory boundary. A malicious guest user with access to a 9P mount can exploit this to read/write arbitrary host files and execute commands as the QEMU process user, achieving a VM escape. The regression was introduced in QEMU v6.1.0 by commit 8d6cb100731c.