The virgl forgets to initialize the memory pointed by the res->ptr when it creates resource. And the memory can be mapped to the guest kernel when the VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING is issued. However, the guest userspace can read the data in the unintialized host memory by mmaping it from the guest kernel. Upstream fix: https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c
Created virglrenderer tracking bugs for this issue: Affects: epel-8 [bug 2039343] Affects: fedora-all [bug 2039342]
Upstream MR: https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654