In the Linux kernel, the following vulnerability has been resolved:

afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

Fix afs_lookup_server() to not free an existing server's endpoint state
when cleaning up a candidate server.  The candidate record doesn't have an
endpoint state yet at this point, so the free for that can just be removed.