Surprise disk unplug can free host memory under an in-flight request
Brief
A plain host-driven unplug was already safe.
Notes
5bdc12fed592 (Denis V. Lunev, 2026-08-18). hw/ide/ahci. Drain the ports on teardown. Surprise removal (slot power or ACPI eject) skipped the cancel that a normal unplug reset does. A plain device_del is not affected. The public commit calls it a host use-after-free. Resolves issue 4069 (issues API 404, treat as non-public). No public CVE id. Trust: unprivileged guest on q35.
Landed with 324bb5ef83ad Merge tag pull-ide-2026-08-26 (2026-08-26 11:26 PT).
Commit 5bdc12fed592a1673f64ca1e8243046632f83a26