Linux kernel (drivers/pci/controller): The Hyper-V PCI front-end frees its PCI domain number twice on a probe failure

CVSS 4.7CVE-2026-43097Kernel, userspace & hypervisorcurated

Impact

The Hyper-V PCI front-end frees its PCI domain number twice on a probe failure - once itself and once again through the bridge release callback. The second free returns an ID that may already have been reissued to a different bus, so two PCI domains can end up carrying the same domain number. Duplicate domain numbering means sysfs paths and device lookups that are supposed to distinguish two hierarchies stop doing so, on the very driver that presents passthrough devices to a guest.

Who can reach it

Guest-side, inside a Linux VM on Hyper-V/Azure that is being given a passthrough device - pci-hyperv is that paravirtual front-end. It requires hv_pci_probe() to fail after the domain number is stored, which is a host- or fabric-side condition (device offer withdrawn, channel setup failing) rather than something guest userspace triggers; a tenant with no control over device offers cannot force it. Nodes not running under Hyper-V never load the driver.

What to do

Boot a kernel where pci-hyperv leaves domain_nr release to the PCI core. Interim: on Hyper-V hosts, watch for the 'ida_free called for id=... which is not allocated' warning as the marker that a domain ID has been double-freed, and restart the affected VM rather than letting it continue with ambiguous domain numbering.

References

https://git.kernel.org/stable/c/21bc8e0ba5c2a081b0a2808c976d4c9dbddf1e48 https://git.kernel.org/stable/c/b6422dff0e518245019233432b6bccfc30b73e2f https://nvd.nist.gov/vuln/detail/CVE-2026-43097

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.