CVE-2026-97584

A flaw was found in the Linux kernel's AFS (Andrew File System) subsystem. During server lookup operations, the candidate cleanup routine incorrectly frees memory associated with an existing server's endpoint state. A local user interacting with the filesystem could exploit this issue to trigger memory corruption, leading to a kernel crash and Denial of Service (DoS).

This vulnerability is rated Moderate because exploitation requires local access and relies on the in-kernel AFS filesystem being actively mounted and queried, which is not configured by default in standard Red Hat deployments. Flawed memory release logic during server resolution can trigger memory corruption, resulting in a kernel panic and subsequent denial of service. The overall blast radius is limited since unprivileged users cannot mount network filesystems arbitrarily, restricting potential impact to systems running dedicated AFS client workloads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.