CVE-2026-98775: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
In the Linux kernel, the following vulnerability has been resolved:
nitroenclaves: fix use-after-free on SLOTALLOC failure
When necreatevmioctl() fails the SLOTALLOC request after anoninodegetfile() has succeeded, the error path calls fput(enclavefile) and then frees neenclave.
In normal userspace context, fput() defers the final fput() via taskwork. neenclaverelease() therefore runs after neenclave has already been freed and dereferences neenclave->slotuid, causing a use-after-free: KASAN: slab-use-after-free in neenclaverelease.
The enclave has no slot allocated and is not yet linked into the enclaves list on this error path, so neenclaverelease() is expected to return early when slotuid is zero. However, reading slotuid already accesses the freed object.
Clear enclavefile->privatedata before fput() on the error path. neenclaverelease() then returns immediately when privatedata is NULL, leaving the ioctl error path as the sole owner of neenclave. This is safe because the file has not been fdinstall()'d yet.
Tested on an AWS EC2 m5.2xlarge with CONFIGKASAN=y. Without the patch, the reproducer triggers a KASAN slab-use-after-free on every SLOTALLOC failure. With the patch, no KASAN report is produced and the SLOTALLOC error is still returned. Normal enclave creation and teardown are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
When can this use-after-free be triggered?
It occurs when ne_create_vm_ioctl() reaches a SLOT_ALLOC failure after anon_inode_getfile() has succeeded. The affected error path calls fput() and frees the enclave object before the deferred file-release handler accesses it.
Is an enclave file descriptor exposed to userspace when the flaw occurs?
No. On this error path, fd_install() has not yet been called, so the enclave file has not been installed as a userspace file descriptor.
What changes in the fix?
The fix clears enclave_file->private_data before calling fput() on the SLOT_ALLOC failure path. This makes ne_enclave_release() return immediately and leaves the ioctl error path as the sole owner of the enclave object.
How was the issue observed?
Without the fix, a reproducer triggered a KASAN slab-use-after-free in ne_enclave_release() on every SLOT_ALLOC failure. The fix was tested on an AWS EC2 m5.2xlarge with CONFIG_KASAN enabled.