Executive brief
A vulnerability in the Linux kernel's Hyper-V PCI driver could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs during the initialization of virtual hardware components, where the system incorrectly attempts to release the same memory resource twice if an error occurs. This instability can disrupt server operations and impact the overall reliability of virtualized environments.
Technical details
A double-free vulnerability exists in the hv_pci_probe() function within drivers/pci/controller/pci-hyperv.c. When the probe function fails after assigning a domain number, it explicitly calls pci_bus_release_emul_domain_nr(). However, the PCI core's bridge release callback, pci_release_host_bridge_dev(), also attempts to free the same domain_nr, leading to a double ida_free() call. This is reachable by a local attacker who can trigger device probing errors. The fix involves removing the redundant explicit free call in the pci-hyperv driver and allowing the PCI core to manage the resource cleanup. Patches have been released for affected stable branches.
Affected products
- Linux Linux kernel 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-03: other: Patch submitted by Sahil Chandna
- 2026-05-06: disclosed: CVE-2026-43097 published
- 2026-05-06: advisory