CVE-2026-97584: afs: Fix incorrect free in candidate cleanup in afs_lookup_server()
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix incorrect free in candidate cleanup in afslookupserver()
Fix afslookupserver() to not free an existing server's endpoint state when cleaning up a candidate server. The candidate record doesn't have an endpoint state yet at this point, so the free for that can just be removed.
Affected Software
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems running a Linux kernel containing the affected AFS server lookup code are relevant. The issue is in AFS candidate-server cleanup, where cleanup could free endpoint state belonging to an existing server.
What condition is involved in triggering the faulty cleanup?
The problem occurs when afs_lookup_server() cleans up a candidate server record while an existing server's endpoint state is involved. At that point, the candidate record has no endpoint state of its own, so freeing endpoint state is incorrect.
What is the remediation?
Apply a Linux kernel update that includes the afs_lookup_server() fix referenced in the provided stable kernel commits. The correction removes the endpoint-state free from candidate cleanup.