CVE-2026-98775: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
In the Linux kernel, the following vulnerability has been resolved:
nitroenclaves: fix use-after-free on SLOTALLOC failure
When necreatevmioctl() fails the SLOTALLOC request after anoninodegetfile() has succeeded, the error path calls fput(enclavefile) and then frees neenclave.
In normal userspace context, fput() defers the final fput() via taskwork. neenclaverelease() therefore runs after neenclave has already been freed and dereferences neenclave->slotuid, causing a use-after-free: KASAN: slab-use-after-free in neenclaverelease.
The enclave has no slot allocated and is not yet linked into the enclaves list on this error path, so neenclaverelease() is expected to return early when slotuid is zero. However, reading slotuid already accesses the freed object.
Clear enclavefile->privatedata before fput() on the error path. neenclaverelease() then returns immediately when privatedata is NULL, leaving the ioctl error path as the sole owner of neenclave. This is safe because the file has not been fdinstall()'d yet.
Tested on an AWS EC2 m5.2xlarge with CONFIGKASAN=y. Without the patch, the reproducer triggers a KASAN slab-use-after-free on every SLOTALLOC failure. With the patch, no KASAN report is produced and the SLOTALLOC error is still returned. Normal enclave creation and teardown are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the nitro_enclaves SLOT_ALLOC failure path, clear enclave_file->private_data before calling fput(enclave_file), and make ne_enclave_release() return early when slot_uid is zero.