CVE-2026-98775: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98775 is a use-after-free vulnerability in the Linux kernel's Nitro Enclaves (nitro_enclaves) driver. It arises in the ne_create_vm_ioctl() function when a SLOT_ALLOC request fails after anon_inode_getfile() has already succeeded, causing ne_enclave_release() to dereference a freed enclave object. The vulnerability affects Linux kernel versions starting from 5.10 up to the fixed stable releases. It was published on October 18, 2026, with patches released across multiple stable branches. The CVSS category is estimated as Medium (Feedly, MSRC).

The root cause is a use-after-free (CWE-416) in the Linux kernel's nitro_enclaves driver. In ne_create_vm_ioctl(), when SLOT_ALLOC fails after anon_inode_getfile() succeeds, the error path calls fput(enclave_file) and then frees ne_enclave. Because fput() defers the final __fput() via task_work in normal userspace context, ne_enclave_release() runs asynchronously after ne_enclave has already been freed, and dereferences ne_enclave->slot_uid, triggering a KASAN slab-use-after-free. The fix clears enclave_file->private_data to NULL before calling fput() on the error path, causing ne_enclave_release() to return immediately when private_data is NULL — this is safe because the file has not yet been installed via fd_install(). Exploitation requires local access with the ability to invoke Nitro Enclaves ioctl operations (Feedly).

A local user with sufficient privileges to invoke Nitro Enclaves ioctl operations can trigger the SLOT_ALLOC failure condition, causing the kernel to read from (and potentially write to) freed memory. This can result in kernel memory corruption, potentially enabling arbitrary kernel code execution or a kernel crash (denial of service). The impact is confined to systems running the affected Linux kernel versions with the Nitro Enclaves driver enabled, such as AWS EC2 instances using Nitro Enclaves (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is locally exploitable only, requiring access to Nitro Enclaves ioctl operations (typically root or appropriate capabilities). The EPSS score is approximately 0.168%, reflecting low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Nessus detection plugins (IDs 371808 and 371781) are available for scanning (Tenable).

Apply the kernel patch that clears enclave_file->private_data before fput() on the error path. Fixed versions are available across multiple stable branches: 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc6 and later. AWS Amazon Linux 2 users should apply updates referenced in ALAS2KERNEL-5.15-2026-117, ALAS2KERNEL-5.10-2026-135, ALAS2KERNEL-5.4-2026-134, and ALAS2-2026-4036. As a workaround, restrict access to Nitro Enclaves ioctl operations to trusted users only (Feedly, AWS ALAS).