All vulnerabilities
CVE-2026-97584

Linux: afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in981d72663dee2fa6efaf202293e68d2b10a0d1d4Also 349e713039a1fd6659c27e7a66238bfa49ce37e9, 044d596094af4b769fb8e1173dff0d08bd68db6c and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 981d72663dee2fa6efaf202293e68d2b10a0d1d4LinuxCVE List
  • 349e713039a1fd6659c27e7a66238bfa49ce37e9LinuxCVE List
  • 044d596094af4b769fb8e1173dff0d08bd68db6cLinuxCVE List
  • 6.12.111LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

Fix afs_lookup_server() to not free an existing server's endpoint state when cleaning up a candidate server. The candidate record doesn't have an endpoint state yet at this point, so the free for that can just be removed.

Text from CVE List

Affected versions 11

  • Linuxaffected: d6aa05cd995830f6dcee7b139335edb266de38a6 before 981d72663dee2fa6efaf202293e68d2b10a0d1d4CVE List
  • Linuxaffected: 4882ba78574e2d8c579658f65f6784b0d139d173 before e5bc0fa9959dc8f7eb1afab7c039594a16a1a65cCVE List
  • Linuxaffected: 4882ba78574e2d8c579658f65f6784b0d139d173 before 349e713039a1fd6659c27e7a66238bfa49ce37e9CVE List
  • Linuxaffected: 4882ba78574e2d8c579658f65f6784b0d139d173 before 044d596094af4b769fb8e1173dff0d08bd68db6cCVE List
  • Linuxaffected: 6.12.101 before 6.12.111CVE List
  • Linuxaffected: 6.15CVE List
  • Linuxunaffected: all versions before 6.15CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4