In the Linux kernel, the following vulnerability has been resolved: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure When… (CVE-2026-98775)

The vulnerability in the Linux kernel's nitro_enclaves arises from a use-after-free condition triggered when the SLOT_ALLOC request fails after anon_inode_getfile() has succeeded in ne_create_vm_ioctl(). The error path calls fput(enclave_file) and frees ne_enclave, but ne_enclave_release() runs after ne_enclave is freed, dereferencing ne_enclave->slot_uid and causing a KASAN slab-use-after-free. The root cause is that enclave_file->private_data is not cleared before fput(), leading to delayed release logic accessing freed memory. The fix clears private_data before fput(), causing ne_enclave_release() to return immediately when private_data is NULL, preventing use-after-free. This fix was tested on AWS EC2 with CONFIG_KASAN=y and prevents the KASAN error without affecting normal enclave creation or teardown.

This vulnerability causes a kernel use-after-free condition that can lead to memory corruption and potential kernel crashes or undefined behavior. It is detected by KASAN as a slab-use-after-free error. There is no indication of active exploitation in the wild. The impact is limited to error paths during enclave creation failures and does not affect normal enclave operations.

A fix is available that clears enclave_file->private_data before calling fput() on the error path, preventing use-after-free in ne_enclave_release(). Applying the official patch or updating to a kernel version that includes this fix is recommended. No additional mitigation is required as the patch safely handles the error path without impacting normal functionality.