The kernel contains a double free bug in the Hyper‑V PCI probe routine: when the probe fails after assigning a domain number, the driver frees the number and the core PCI cleanup also frees it, causing the same ID to be freed twice and generating an "ida_free called for id … which is not allocated" warning. This flaw is a classic double free (CWE‑1341) and can lead to kernel instability.

All Linux kernel builds that include the hv_pci_probe implementation and have not applied the recent patch removing the explicit free, particularly systems running Hyper‑V guest services where the hv PCI bridge driver is active.

The CVSS score of 7.8 indicates a high severity risk, primarily affecting system stability. The EPSS score of < 1% implies a very low likelihood of exploitation in the wild. The flaw only produces a warning in the current kernel releases but, because it involves a double free, the potential exists for a kernel panic or further memory corruption if exploited. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local kernel exploitation; an attacker would need to trigger the failing probe path on a system with kernel privileges.