GHSA-QMFR-QQ4J-JRFC
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-14 21:30In the Linux kernel, the following vulnerability has been resolved:
PCI: hv: Fix double ida_free in hv_pci_probe error path
If hv_pci_probe() fails after storing the domain number in hbus->bridge->domain_nr, there is a call to free this domain_nr via pci_bus_release_emul_domain_nr(), however, during cleanup, the bridge release callback pci_release_host_bridge_dev() also frees the domain_nr causing ida_free to be called on same ID twice and triggering following warning:
ida_free called for id=28971 which is not allocated. WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198 Call Trace: pci_bus_release_emul_domain_nr+0x17/0x20 pci_release_host_bridge_dev+0x4b/0x60 device_release+0x3b/0xa0 kobject_put+0x8e/0x220 devm_pci_alloc_host_bridge_release+0xe/0x20 devres_release_all+0x9a/0xd0 device_unbind_cleanup+0x12/0xa0 really_probe+0x1c5/0x3f0 vmbus_add_channel_work+0x135/0x1a0
Fix this by letting pci core handle the free domain_nr and remove the explicit free called in pci-hyperv driver.
{
"affected": [],
"aliases": [
"CVE-2026-43097"
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T10:16:23Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: hv: Fix double ida_free in hv_pci_probe error path\n\nIf hv_pci_probe() fails after storing the domain number in\nhbus-\u003ebridge-\u003edomain_nr, there is a call to free this domain_nr via\npci_bus_release_emul_domain_nr(), however, during cleanup, the bridge\nrelease callback pci_release_host_bridge_dev() also frees the domain_nr\ncausing ida_free to be called on same ID twice and triggering following\nwarning:\n\n ida_free called for id=28971 which is not allocated.\n WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198\n Call Trace:\n pci_bus_release_emul_domain_nr+0x17/0x20\n pci_release_host_bridge_dev+0x4b/0x60\n device_release+0x3b/0xa0\n kobject_put+0x8e/0x220\n devm_pci_alloc_host_bridge_release+0xe/0x20\n devres_release_all+0x9a/0xd0\n device_unbind_cleanup+0x12/0xa0\n really_probe+0x1c5/0x3f0\n vmbus_add_channel_work+0x135/0x1a0\n\nFix this by letting pci core handle the free domain_nr and remove\nthe explicit free called in pci-hyperv driver.",
"id": "GHSA-qmfr-qq4j-jrfc",
"modified": "2026-05-14T21:30:36Z",
"published": "2026-05-06T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43097"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/21bc8e0ba5c2a081b0a2808c976d4c9dbddf1e48"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b6422dff0e518245019233432b6bccfc30b73e2f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.