QEMU plugs virtio-rng use-after-free on hot-unplug

QEMU has a fix underway for CVE-2026-50624, a host heap use-after-free in the virtio-rng path that could fire when the device was hot-unplugged while an entropy request was still outstanding.

The bug, reported by Jia Jia, appears when the rng-random backend finishes a request after the virtio-rng frontend is already gone. The delayed completion then runs against freed host memory. That is a host-side memory safety failure tied to device removal, not a guest-to-guest data leak.

Laurent Vivier’s patch cancels any pending entropy callbacks for that frontend when the device is torn down, so a late backend completion has nothing left to invoke. The change is aimed at hosts that expose virtio-rng and allow hot-unplug of that device; operators who never remove the RNG at runtime are outside the practical trigger path.

The work resolves the related QEMU project issue and carries the CVE identifier in the submission on the qemu-devel list.