QEMU patches QXL use-after-free on hot-unplug

QEMU has fixed a use-after-free in the QXL display device that struck after a secondary graphics adapter was hot-unplugged. The bug, CVE-2026-63322, left a VM state-change handler and three bottom halves still registered against memory that had already been freed with the device. The next stop, continue, migrate, or deferred callback would then dereference the dangling pointers.

Secondary QXL devices are hotpluggable by default, so ordinary device_del workflows against Spice graphics could reach the path. Haotian Jiang of Tencent identified the missing teardown and supplied the fix: keep the handler registration and add an exit callback that unregisters the handler, deletes the bottom halves, and frees related allocations before the device object itself is released. Marc-André Lureau reviewed the change. The defect dates to the original QXL device introduction and is flagged for stable backports.