A use‑after‑free bug exists in the Linux kernel Nitro Enclaves subsystem. When an enclave creation ioctl fails after allocating the anonymized inode but before the slot allocation succeeds, the error path frees the enclave object before the reference count is fully released. Task‑work then runs the release routine on the already‑freed object, dereferencing memory that has been reclaimed. This results in a KASAN slab‑use‑after‑free and, if exploitable, could allow a local attacker to corrupt kernel memory or elevate privileges. Based on the description, it is inferred that the vulnerability could lead to local privilege escalation.

Affected systems include any Linux kernel builds that contain Nitro Enclaves support. The vulnerability is exercised by the ne_create_vm_ioctl interface and is present in all kernel versions that do not contain the commit that clears enclave_file->private_data before fput(). The affected component is the kernel module that implements Nitro enclave functionality.

Risk and exploitability: The vulnerability is not listed in the CISA KEV catalog, and the EPSS score indicates less than 1% probability of exploitation. The CVSS score is 5.5, reflecting moderate severity. Exploitation would require the ability to invoke the Nitro Enclaves ioctl interface, implying local or elevated process access. Based on the description, the likely attack vector is local or requires elevated process access. In the absence of the patch, the bug could be triggered automatically on any kernel that attempts to create an enclave where the slot allocation fails.