High 7.8Published Sep 25, 2026

CVE-2026-97584afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

Updated under an hour ago (2026-10-19 08:40 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: afs: Fix incorrect free in candidate cleanup in afs_lookup_server() Fix afs_lookup_server() to not free an existing server's endpoint state when cleaning up a candidate server. The candidate record doesn't have an endpoint state yet at this point, so the free for that can just be removed.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Sep 25, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d6aa05cd995830f6dcee7b139335edb266de38a6 before 981d72663dee2fa6efaf202293e68d2b10a0d1d4; from 4882ba78574e2d8c579658f65f6784b0d139d173 before e5bc0fa9959dc8f7eb1afab7c039594a16a1a65c; 4882ba78574e2d8c579658f65f6784b0d139d173 builds before 349e713039a1fd6659c27e7a66238bfa49ce37e9; 4882ba78574e2d8c579658f65f6784b0d139d173 builds before 044d596094af4b769fb8e1173dff0d08bd68db6c; from 6.12.101 before 6.12.111	CNA record

References

https://git.kernel.org/stable/c/981d72663dee2fa6efaf202293e68d2b10a0d1d4
https://git.kernel.org/stable/c/e5bc0fa9959dc8f7eb1afab7c039594a16a1a65c
https://git.kernel.org/stable/c/349e713039a1fd6659c27e7a66238bfa49ce37e9
https://git.kernel.org/stable/c/044d596094af4b769fb8e1173dff0d08bd68db6c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.