afs ServerLookup UAF

Vulnerability analysis

In the AFS network filesystem client, the server lookup routine allocates a candidate server record when no existing server is found. If the cleanup path is reached — for instance when a concurrent lookup has already created the server — the code incorrectly frees the endpoint state belonging to the existing, in-use server record instead of the candidate's. The candidate never had an endpoint state allocated at that point, so the freed object remains referenced by the live server, producing a use-after-free. The fix simply removes the erroneous free call. A local user with access to an AFS mount can trigger this by performing filesystem operations that cause concurrent server lookups, and the resulting heap corruption can compromise kernel memory integrity and stability.