In QEMU's 9pfs (virtio-9p) implementation, the TXATTRCREATE and TXATTRWALK request handlers do not limit the number of simultaneously open xattr FIDs. Each xattr FID allocates a
host memory buffer for the extended attribute value. A malicious privileged guest user with direct 9p server access can exploit this by repeatedly creating xattr FIDs without closing
them, leading to unbounded host memory consumption and eventual host memory exhaustion (denial of service). This vulnerability has existed since QEMU v0.14.0-rc0 and is fixed in
v11.0.3 and v10.0.12.