CVE-2026-43097

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: hv: Fix double ida_free in hv_pci_probe error path

If hv_pci_probe() fails after storing the domain number in

hbus->bridge->domain_nr, there is a call to free this domain_nr via

pci_bus_release_emul_domain_nr(), however, during cleanup, the bridge

release callback pci_release_host_bridge_dev() also frees the domain_nr

causing ida_free to be called on same ID twice and triggering following

warning:

ida_free called for id=28971 which is not allocated.

WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198

Call Trace:

pci_bus_release_emul_domain_nr+0x17/0x20

pci_release_host_bridge_dev+0x4b/0x60

device_release+0x3b/0xa0

kobject_put+0x8e/0x220

devm_pci_alloc_host_bridge_release+0xe/0x20

devres_release_all+0x9a/0xd0

device_unbind_cleanup+0x12/0xa0

really_probe+0x1c5/0x3f0

vmbus_add_channel_work+0x135/0x1a0

Fix this by letting pci core handle the free domain_nr and rem

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References