CVE-2026-98775

In the Linux kernel, the following vulnerability has been resolved:

nitro enclaves: fix use-after-free on SLOT ALLOC failure

When ne create vm ioctl() fails the SLOT ALLOC request after anon inode getfile() has succeeded, the error path calls fput(enclave file) and then frees ne enclave.

In normal userspace context, fput() defers the final fput() via task work. ne enclave release() therefore runs after ne enclave has already been freed and dereferences ne enclave->slot uid, causing a use-after-free: KASAN: slab-use-after-free in ne enclave release.

The enclave has no slot allocated and is not yet linked into the enclaves list on this error path, so ne enclave release() is expected to return early when slot uid is zero. However, reading slot uid already accesses the freed object.

Clear enclave file->private data before fput() on the error path. ne enclave release() then returns immediately when private data is NULL, leaving the ioctl error path as the sole owner of ne enclave. This is safe because the file has not been fd install()'d yet.

Tested on an AWS EC2 m5.2xlarge with CONFIG KASAN=y. Without the patch, the reproducer triggers a KASAN slab-use-after-free on every SLOT ALLOC failure. With the patch, no KASAN report is produced and the SLOT ALLOC error is still returned. Normal enclave creation and teardown are unaffected.