QEMU fixes virtio-gpu use-after-free on blob detach

QEMU has patched a use-after-free in the virtio-gpu display device that left blob resource backing reachable after a guest detached it. The flaw is tracked as CVE-2026-66020.

When cleanup tore down a blob mapping, the resource still advertised a non-zero blob size and a stale pointer. An UPDATE_CURSOR command could then memcpy from freed memory. Detach also left any scanout surface that had been built over the blob installed, so a later display refresh could read the unmapped backing.

Marc-André Lureau of Red Hat fixed both paths by disabling active scanouts that reference the resource before the mapping is destroyed, clearing the blob pointer afterward, and refusing to dereference a missing blob during cursor updates. The issue was reported by 章鱼哥@aipy and swing.

Virtio-gpu is a common path for guest graphics; a malicious or buggy guest that can issue the detach and follow-up commands could crash the host QEMU process or read residual data from the freed mapping.