Description

In the Linux kernel, the following vulnerability has been resolved: afs: Fix incorrect free in candidate cleanup in afs_lookup_server() Fix afs_lookup_server() to not free an existing server's endpoint state when cleaning up a candidate server. The candidate record doesn't have an endpoint state yet at this point, so the free for that can just be removed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:09.267Z",
  "pubdate": "2026-09-25T11:17:09.267Z",
  "executiveSummary": "A memory corruption vulnerability exists in the Linux kernel's AFS (Andrew File System) client implementation, specifically within the afs_lookup_server function.\nThe vulnerability is categorized as a Use-After-Free (UAF) flaw caused by improper resource management during the cleanup of candidate server records.\nAn attacker capable of triggering server lookup operations could potentially exploit this flawed cleanup logic to induce a kernel-level memory management error, leading to system instability, denial of service (DoS), or potential arbitrary code execution.\nThe flaw stems from an incorrect deallocation of existing server endpoint state during a failed candidate server registration attempt.\nExploitation requires the ability to interact with the AFS client, which typically necessitates network access to an AFS cell or the ability to mount an AFS filesystem, depending on local system configuration and user privileges.",
  "technicalDetails": "The vulnerability resides in the function afs_lookup_server() within the Linux kernel AFS filesystem client. The root cause is a flawed cleanup routine invoked when a candidate server record fails to initialize correctly or is redundant.\nDuring the server lookup process, the kernel allocates and initializes candidate records to represent prospective AFS servers. If the process encounters an error while integrating a candidate, it must clean up the partially initialized data structures.\nIn the vulnerable version, the error handling path in afs_lookup_server() erroneously attempts to free the endpoint state of the candidate record. However, because the candidate record has not yet been fully initialized to possess its own endpoint state, the deallocation logic incorrectly targets the endpoint state belonging to an existing, valid server object residing in the cache or the server list.\nThis behavior results in a Use-After-Free condition where the memory previously associated with a valid server's endpoint state is returned to the slab allocator while active references to that memory may still exist within other parts of the AFS client. Subsequent access to this dangling pointer by other threads or kernel functions leads to undefined behavior, memory corruption, or kernel panic.\nAttack Flow: 1. An attacker initiates a series of network-based requests or configuration changes that trigger afs_lookup_server() execution. 2. By controlling the conditions under which a candidate server fails registration, the attacker forces the execution flow into the flawed cleanup path. 3. The kernel executes the incorrect kfree() operation, deallocating the endpoint state of an existing, functional AFS server. 4. The attacker maintains pressure on the kernel, triggering further AFS operations that attempt to access the now-freed memory address. 5. The resulting kernel memory fault causes a crash, or, if the memory is reallocated to a malicious user-controlled object, allows for controlled influence over kernel-space operations.\nThe impact includes critical system instability and potential kernel heap spraying if the attacker can influence the slab allocator's behavior post-free. Because this logic is embedded deep within the kernel filesystem implementation, it operates with kernel-level privileges."
}