Peter Pi discovered a buffer overflow in the virtio network backend (vhost_net) implementation in the Linux kernel. An attacker in a guest may be able to use this to cause a denial of service (host OS crash) or possibly execute arbitrary code in the host OS.
2ae10bdb1c9632e027b75b76ad2d6e3b299967f41342245c237b87d05be2b799