In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access...

In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent shared memory modification due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.