QEMU fixes virtio-pmem use-after-free on hot-unplug

Michael S. Tsirkin has fixed a use-after-free in QEMU's virtio-pmem device that could trigger when the device was deleted, for example by hot-unplug.

The device submits fsync work to a thread pool and stores a pointer to itself in each request. If removal happened while those flushes were still running, the completion callback could execute after the device object had already been freed, producing a use-after-free.

The change tracks in-flight flush requests and makes device teardown wait until their completions finish before the object is destroyed. The issue is tracked as CVE-2026-63323 and has existed since virtio-pmem was first introduced.