CVE-2026-43278 is a use-after-free and double-free vulnerability in the Linux kernel's device-mapper (dm) subsystem. It occurs due to stale bio pointers in cloned request bios, which can lead to double freeing of memory. This issue was observed in scenarios such as dm-multipath on PCIe NVMe namespaces. The flaw has been fixed by clearing the bio pointer when the last cloned bio completes to prevent double freeing.