udevd calls (internal) blkid, which opens the device, so kpartx -d cannot remove it.
To not expose dom0 processes like blkid for attacks from VM (e.g. by placing malicious filesystem header in private.img).