# CVE-2026-43097: linux: In the Linux kernel, the following vulnerability has been resolved:  PCI: hv: Fix double ida_free in hv_pci_probe err...

CVE-2026-43097 is fixed in linux on 1 platform by DEBIAN-CVE-2026-43097 (version 6.19.14-1), released May 15, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-43097
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0012
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 6, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  PCI: hv: Fix double ida_free in hv_pci_probe error path  If hv_pci_probe() fails after storing the domain number in hbus->bridge->domain_nr, there is a call to free this domain_nr via pci_bus_release_emul_domain_nr(), however, during cleanup, the bridge release callback pci_release_host_bridge_dev() also frees the domain_nr causing ida_free to be called on same ID twice and triggering following warning:    ida_free called for id=28971 which is not allocated.   WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198   Call Trace:    pci_bus_release_emul_domain_nr+0x17/0x20    pci_release_host_bridge_dev+0x4b/0x60    device_release+0x3b/0xa0    kobject_put+0x8e/0x220    devm_pci_alloc_host_bridge_release+0xe/0x20    devres_release_all+0x9a/0xd0    device_unbind_cleanup+0x12/0xa0    really_probe+0x1c5/0x3f0    vmbus_add_channel_work+0x135/0x1a0  Fix this by letting pci core handle the free domain_nr and remove the explicit free called in pci-hyperv driver.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.19.14-1 | [DEBIAN-CVE-2026-43097](https://patchblox.com/security/data/fix/linux/debian-cve-2026-43097.md) | May 15, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.