A use-after-free vulnerability (CVE-2025-11234) exists in QEMU's qemu-kvm package, specifically in the handling of the VNC WebSocket handshake. If the QIOChannelWebsock object is freed while waiting for handshake completion, a GSource is leaked, which may cause the callback to execute on a freed object, leading to a use-after-free condition. This flaw can be triggered by a remote attacker with network access to the VNC WebSocket port, resulting in denial of service during the handshake phase prior to authentication. Red Hat has released patches for Red Hat Enterprise Linux 9.4 Extended Update Support and OpenShift Container Platform 4.16.55 to address this issue. The vulnerability has a CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting high impact on availability but no confidentiality or integrity impact.

The vulnerability allows a remote unauthenticated attacker with network access to the VNC WebSocket port to cause a denial of service by triggering a use-after-free during the WebSocket handshake. This results in a crash or instability of the qemu-kvm process, impacting availability of virtual machine services relying on VNC WebSocket connections. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported.

Red Hat has released official security updates addressing CVE-2025-11234 for affected products including Red Hat Enterprise Linux 9.4 Extended Update Support and OpenShift Container Platform 4.16.55. Users should apply these patches promptly following the vendor's instructions available at https://access.redhat.com/articles/11258 and the OpenShift update documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli. Since patches are available, updating to the fixed versions is the recommended mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.