CVE-2026-98775

Received Received - Intake

Use-After-Free in Linux Kernel Nitro Enclaves

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure When ne_create_vm_ioctl() fails the SLOT_ALLOC request after anon_inode_getfile() has succeeded, the error path calls fput(enclave_file) and then frees ne_enclave. In normal userspace context, fput() defers the final __fput() via task_work. ne_enclave_release() therefore runs after ne_enclave has already been freed and dereferences ne_enclave->slot_uid, causing a use-after-free: KASAN: slab-use-after-free in ne_enclave_release. The enclave has no slot allocated and is not yet linked into the enclaves list on this error path, so ne_enclave_release() is expected to return early when slot_uid is zero. However, reading slot_uid already accesses the freed object. Clear enclave_file->private_data before fput() on the error path. ne_enclave_release() then returns immediately when private_data is NULL, leaving the ioctl error path as the sole owner of ne_enclave. This is safe because the file has not been fd_install()'d yet. Tested on an AWS EC2 m5.2xlarge with CONFIG_KASAN=y. Without the patch, the reproducer triggers a KASAN slab-use-after-free on every SLOT_ALLOC failure. With the patch, no KASAN report is produced and the SLOT_ALLOC error is still returned. Normal enclave creation and teardown are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98775

EUVD

EUVD-2026-103860

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9c8eb50fe9e2bb8a2e725979e052fbf592b6b799
Linux	Linux	9c8eb50fe9e2bb8a2e725979e052fbf592b6b799
Linux	Linux	9c8eb50fe9e2bb8a2e725979e052fbf592b6b799
Linux	Linux	9c8eb50fe9e2bb8a2e725979e052fbf592b6b799
Linux	Linux	5.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's nitro_enclaves component. It occurs when a specific ioctl operation fails after a file has been created but before it is fully linked to the enclave system. The error path attempts to free the enclave object while a deferred file cleanup operation still references it, leading to a use-after-free condition that can cause system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's nitro_enclaves component and requires kernel-level detection. Check if your kernel version includes the vulnerable code path by examining the nitro_enclaves module and looking for SLOT_ALLOC failure scenarios. Use KASAN (Kernel Address Sanitizer) to detect use-after-free errors during enclave operations.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel crash or memory corruption by exploiting the use-after-free condition. This may lead to denial-of-service attacks or potentially enable privilege escalation if combined with other exploits. Systems using AWS Nitro Enclaves are particularly affected.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's nitro_enclaves component. It does not directly impact compliance with standards like GDPR or HIPAA as it is a low-level memory corruption issue rather than a data exposure or privacy violation. Compliance risks would only arise if this flaw were exploited to gain unauthorized access or cause system instability affecting regulated data processing.

Mitigation Strategies

Apply the kernel patch that clears enclave_file->private_data before fput() on the error path. Update to a kernel version that includes the fix for CVE-2026-98775. If immediate patching is not possible, disable the nitro_enclaves module until the fix is applied.

Hi! I’m here to help you understand CVE-2026-98775. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70