CVE-2026-43097 Overview
CVE-2026-43097 is a double-free defect in the Linux kernel's PCI Hyper-V driver (pci-hyperv). When hv_pci_probe() fails after assigning a domain number to hbus->bridge->domain_nr, both the driver and the PCI core attempt to release the same identifier. The driver calls pci_bus_release_emul_domain_nr() directly, while the bridge release callback pci_release_host_bridge_dev() frees the same domain_nr during cleanup. The result is ida_free invoked twice on the same ID, producing a kernel warning from lib/idr.c:594.
Critical Impact
The double ida_free corrupts the IDA allocator state for PCI domain numbers and emits a WARNING in kernel logs, potentially destabilizing PCI passthrough on Hyper-V guests.
Affected Products
- Linux kernel builds containing the pci-hyperv driver prior to the upstream fix
- Hyper-V guest virtual machines using PCI passthrough
- Distributions tracking the affected stable kernel branches
Discovery Timeline
- 2026-05-06 - CVE CVE-2026-43097 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43097
Vulnerability Analysis
The defect lives in the error path of hv_pci_probe() in the Linux kernel's PCI Hyper-V driver. Probe assigns a PCI domain identifier through the IDA (ID Allocator) and stores it in hbus->bridge->domain_nr. If a later step in probe fails, the cleanup logic calls pci_bus_release_emul_domain_nr() to release the ID. However, the bridge object also owns a release callback, pci_release_host_bridge_dev(), which independently frees domain_nr when the device's reference count reaches zero through kobject_put().
The call trace from the warning shows the second free originating from devm_pci_alloc_host_bridge_release() during devres_release_all(), triggered by device_unbind_cleanup() after really_probe() fails. Because the same identifier is returned to the IDA twice, the second ida_free() invocation logs ida_free called for id=28971 which is not allocated and emits a WARNING at ida_free+0xdf/0x160.
Root Cause
The root cause is duplicated ownership of the domain_nr lifecycle [Double Free]. Both the driver-specific cleanup and the PCI core's bridge release callback assume responsibility for releasing the IDA-allocated domain number. The fix delegates the free exclusively to the PCI core by removing the explicit pci_bus_release_emul_domain_nr() call from pci-hyperv.
Attack Vector
The condition is reached only when hv_pci_probe() fails after the domain number is stored. Trigger paths are constrained to Hyper-V guests performing PCI device probing. There is no published exploit, no CISA KEV listing, and the EPSS data reflects negligible exploitation likelihood. The defect's primary consequence is a kernel warning and corrupted IDA state rather than direct memory corruption of arbitrary data. Reference patches are available in the upstream stable tree at commit 21bc8e0 and commit b6422df.
Detection Methods for CVE-2026-43097
Indicators of Compromise
- Kernel log entries containing ida_free called for id=<N> which is not allocated
- WARNING stack traces referencing pci_bus_release_emul_domain_nr and pci_release_host_bridge_dev
- Repeated probe failures on Hyper-V PCI passthrough devices preceding the warning
Detection Strategies
- Parse dmesg and /var/log/kern.log for the specific ida_free warning signature
- Correlate vmbus_add_channel_work failures with subsequent IDA warnings on the same CPU
- Track kernel version inventory across Hyper-V guests to identify hosts running unpatched pci-hyperv code
Monitoring Recommendations
- Forward kernel logs from Hyper-V guests to a centralized log pipeline and alert on ida_free and pci_release_host_bridge_dev symbols
- Monitor PCI passthrough device probe success rates as a leading indicator
- Track stable kernel patch adoption across the fleet against the upstream commits referenced in the advisory
How to Mitigate CVE-2026-43097
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits for any affected branch
- Rebuild and redeploy custom kernels using the patched drivers/pci/controller/pci-hyperv.c source
- Validate Hyper-V guest kernel versions through the distribution's package management before reboot
Patch Information
The fix removes the explicit pci_bus_release_emul_domain_nr() call in the pci-hyperv driver and lets the PCI core release the domain number through pci_release_host_bridge_dev(). The change is published in upstream commits 21bc8e0ba5c2 and b6422dff0e51. Distribution vendors are expected to backport the fix to supported stable branches.
Workarounds
- Avoid configurations that cause hv_pci_probe() to fail mid-initialization until the patch is deployed
- Where feasible, disable PCI passthrough on Hyper-V guests running unpatched kernels
- Treat the ida_free warning as advisory only and avoid restarting probe loops that re-trigger the condition
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
