This vulnerability arises when the hv_pci_probe function fails after allocating a PCI emulation domain number. The error path frees the domain number twice—once explicitly in the driver and once through the PCI core release callback—resulting in a double free and a kernel warning. The double free does not immediately expose user data, but it can corrupt internal allocation tables, trigger kernel panics, or lead to resource exhaustion, effectively causing a denial‑of‑service condition for the kernel host. The weakness is a classic double‑free vulnerability (CWE‑414).

The issue is limited to the Linux kernel’s hypervisor PCI driver. It affects all platforms running Linux kernels that include the hv_pci_probe implementation without the recent patch. The vulnerability is specific to the hyperv PCI bridge handling and has been addressed in newer kernel releases as part of the patch that removes the explicit ida_free call.

The risk is moderate from an availability standpoint. While immediate remote exploitation appears unlikely, the lack of a safeguard against repeated ida_free calls can culminate in kernel instability. An attacker could create conditions that repeatedly cause hv_pci_probe failures, thereby exhausting domain numbers or triggering repeated kernel warnings that may eventually lead to a system crash. The vulnerability is not yet flagged as a known exploited flaw, but it merits timely remediation to avoid potential denial of service in environments that use hyperv PCI bridging.