CVE-2026-98775: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98775 Overview

CVE-2026-98775 is a use-after-free vulnerability in the Linux kernel's nitro_enclaves driver. The flaw occurs in ne_create_vm_ioctl() when the SLOT_ALLOC request fails after anon_inode_getfile() has already succeeded. The error path calls fput(enclave_file) and then frees the ne_enclave structure. Because fput() defers the final __fput() via task_work in normal userspace context, ne_enclave_release() subsequently dereferences ne_enclave->slot_uid on an already-freed object. KASAN reports a slab-use-after-free on every triggered failure path.

Critical Impact
Local users capable of invoking the Nitro Enclaves ioctl can trigger kernel memory corruption through a reliably reachable error path on AWS EC2 and other Linux systems using the driver.

Affected Products

Linux kernel builds containing the nitro_enclaves driver
AWS EC2 instances with Nitro Enclaves support enabled (confirmed on m5.2xlarge with CONFIG_KASAN=y)
Downstream distributions shipping the vulnerable drivers/virt/nitro_enclaves code prior to the referenced stable commits

Discovery Timeline

2026-10-18 - CVE-2026-98775 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98775

Vulnerability Analysis

The vulnerability resides in the Nitro Enclaves driver ioctl path responsible for creating a new enclave virtual machine. The function ne_create_vm_ioctl() sequentially allocates the ne_enclave structure, obtains an anonymous inode file via anon_inode_getfile(), and then issues a SLOT_ALLOC request to the Nitro hypervisor. If SLOT_ALLOC returns an error, the cleanup path releases the file reference and frees the enclave object. The ordering between these two operations creates the window exploited by this flaw.

Root Cause

In userspace process context, fput() does not run the file's release handler synchronously. Instead, it schedules __fput() through the task work queue, which executes when the task returns to userspace. The ioctl error path proceeds to kfree(ne_enclave) immediately after fput(), so by the time ne_enclave_release() runs, the backing memory has been freed and potentially reused. The release handler reads ne_enclave->slot_uid to decide whether to short-circuit, triggering the use-after-free before the early-return logic can take effect.

Attack Vector

A local user with permission to open /dev/nitro_enclaves and issue the enclave creation ioctl can force SLOT_ALLOC to fail and reach the vulnerable cleanup path. Successful exploitation yields kernel-mode memory corruption that could be developed into privilege escalation or a denial-of-service condition. No network vector exists; the attack requires local code execution on a host where the driver is loaded. The upstream fix clears enclave_file->private_data before calling fput(), so ne_enclave_release() returns immediately when private_data is NULL, leaving the ioctl error path as the sole owner of ne_enclave.

See the upstream patches for the exact fix: Kernel Commit 43f78b3, Kernel Commit 466041d, Kernel Commit 8bde6f6, Kernel Commit 9bc184a, and Kernel Commit f7fb6c2.

Detection Methods for CVE-2026-98775

Indicators of Compromise

KASAN kernel log entries reporting slab-use-after-free in ne_enclave_release on hosts with CONFIG_KASAN=y.
Unexpected kernel oops or panic traces referencing ne_create_vm_ioctl or ne_enclave_release in /var/log/messages or dmesg.
Processes repeatedly opening /dev/nitro_enclaves and issuing NE_CREATE_VM ioctls that return errors.

Detection Strategies

Audit kernel logs for stack traces that correlate nitro_enclaves symbols with slab allocator warnings or general protection faults.
Instrument auditd to record open() and ioctl() calls against /dev/nitro_enclaves by non-enclave-management processes.
Run reproducers in a staging environment under KASAN to confirm whether a given kernel build carries the fix.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging pipeline and alert on KASAN, BUG:, or general protection fault strings linked to ne_ symbols.
Track installed kernel versions across the fleet and flag any host still running pre-patch builds that expose /dev/nitro_enclaves.
Baseline the set of users and services expected to interact with Nitro Enclaves, then alert on deviations.

How to Mitigate CVE-2026-98775

Immediate Actions Required

Apply the stable kernel updates referenced by the upstream commits as soon as vendor packages are available for your distribution.
Restrict access to /dev/nitro_enclaves to the specific service accounts that require enclave management.
Reboot affected hosts after kernel package installation to ensure the patched image is loaded.

Patch Information

The fix clears enclave_file->private_data before the fput() call in the ne_create_vm_ioctl() error path. After the patch, ne_enclave_release() observes private_data == NULL and returns immediately, leaving the ioctl error path as the sole owner of the ne_enclave allocation. The patch is safe because the file has not yet been installed into the file descriptor table via fd_install(). The fix is distributed across the kernel stable commits listed in the Technical Details section.

Workarounds

Unload the nitro_enclaves kernel module on hosts that do not require enclave functionality using modprobe -r nitro_enclaves.
Blacklist the module in /etc/modprobe.d/ to prevent reload across reboots on systems where enclaves are not used.
Tighten permissions on /dev/nitro_enclaves so that only trusted enclave orchestration processes can issue ioctls.

bash

# Configuration example
# Prevent the vulnerable driver from loading on hosts that do not use Nitro Enclaves
echo 'blacklist nitro_enclaves' | sudo tee /etc/modprobe.d/disable-nitro-enclaves.conf
sudo modprobe -r nitro_enclaves

# Restrict device node access to a dedicated group
sudo groupadd -f nitro-enclaves
sudo chown root:nitro-enclaves /dev/nitro_enclaves
sudo chmod 0660 /dev/nitro_enclaves