CVE-2023-53481 (GCVE-0-2023-53481)
Vulnerability from cvelistv5
Published
2025-10-01 11:42
Modified
2026-10-15 21:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
Following process will trigger an infinite loop in ubi_wl_put_peb():
ubifs_bgt ubi_bgt
ubifs_leb_unmap
ubi_leb_unmap
ubi_eba_unmap_leb
ubi_wl_put_peb wear_leveling_worker
e1 = rb_entry(rb_first(&ubi->used)
e2 = get_peb_for_wl(ubi)
ubi_io_read_vid_hdr // return err (flash fault)
out_error:
ubi->move_from = ubi->move_to = NULL
wl_entry_destroy(ubi, e1)
ubi->lookuptbl[e->pnum] = NULL
retry:
e = ubi->lookuptbl[pnum]; // return NULL
if (e == ubi->move_from) { // NULL == NULL gets true
goto retry; // infinite loop !!!
$ top
PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND
7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0
Fix it by:
1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has
been removed from 'ubi->lookuptbl'.
2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an
use-after-free problem for wl entry in ubi_wl_put_peb().
Fetch a reproducer in [Link].
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 Version: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 Version: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 Version: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 Version: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 Version: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 Version: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 Version: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-53481",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:34:44.820023Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:41:28.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mtd/ubi/wl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b40d2fbf47af58377e898b5062077a47bb28a132",
"status": "affected",
"version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
"versionType": "git"
},
{
"lessThan": "f006f596fe851c3b6aae60b79f89f89f0e515d2f",
"status": "affected",
"version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
"versionType": "git"
},
{
"lessThan": "b5be23f6ae610bdb262160a1f294afee6d0e6a69",
"status": "affected",
"version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
"versionType": "git"
},
{
"lessThan": "8a18856e074479bd050b01e688c58defadce7ab0",
"status": "affected",
"version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
"versionType": "git"
},
{
"lessThan": "3afaaf6f5867dc4ad383808d4053f428ec7b867d",
"status": "affected",
"version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
"versionType": "git"
},
{
"lessThan": "cc4bc532acda66189bddc03b3fe1ad689d9a48a2",
"status": "affected",
"version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
"versionType": "git"
},
{
"lessThan": "5af1c643184a5d09ff5b3f334077a4d0a163c677",
"status": "affected",
"version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
"versionType": "git"
},
{
"lessThan": "4d57a7333e26040f2b583983e1970d9d460e56b0",
"status": "affected",
"version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mtd/ubi/wl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.308",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.276",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.100",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.308",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.276",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.235",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.100",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.18",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.5",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed\n\nFollowing process will trigger an infinite loop in ubi_wl_put_peb():\n\n\tubifs_bgt\t\tubi_bgt\nubifs_leb_unmap\n ubi_leb_unmap\n ubi_eba_unmap_leb\n ubi_wl_put_peb\twear_leveling_worker\n e1 = rb_entry(rb_first(\u0026ubi-\u003eused)\n\t\t\t e2 = get_peb_for_wl(ubi)\n\t\t\t ubi_io_read_vid_hdr // return err (flash fault)\n\t\t\t out_error:\n\t\t\t ubi-\u003emove_from = ubi-\u003emove_to = NULL\n\t\t\t wl_entry_destroy(ubi, e1)\n\t\t\t ubi-\u003elookuptbl[e-\u003epnum] = NULL\n retry:\n e = ubi-\u003elookuptbl[pnum];\t// return NULL\n\tif (e == ubi-\u003emove_from) {\t// NULL == NULL gets true\n\t goto retry;\t\t\t// infinite loop !!!\n\n$ top\n PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND\n 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0\n\nFix it by:\n 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has\n been removed from \u0027ubi-\u003elookuptbl\u0027.\n 2) Using \u0027ubi-\u003ewl_lock\u0027 protecting wl entry deletion to preventing an\n use-after-free problem for wl entry in ubi_wl_put_peb().\n\nFetch a reproducer in [Link]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached only from local activity \u2014 file writes/unlinks on a mounted UBIFS filesystem driving `ubifs_leb_unmap()`, or `UBI_IOCEBER`/`UBI_IOCEBUNMAP` ioctls on `/dev/ubiX_Y`. There is no network-facing consumer of the UBI wear-leveling layer.\nAC:L - The attacker supplies both the concurrency (unbounded parallel LEB unmaps via ordinary filesystem writes/deletes or a tight ioctl loop) and sustained write pressure that keeps the wear-leveling worker running continuously on flash whose read/ECC errors are the expected operating condition UBI is built to handle; once the error path fires, the `NULL == ubi-\u003emove_from` comparison is deterministic, not probabilistic.\nPR:L - Any unprivileged local user with write access to a UBIFS mount (the standard writable data/rootfs partition on embedded, automotive and IoT devices) can drive `ubi_eba_unmap_leb()` through the UBIFS journal and background thread; the direct ioctl path has no capability check either, only `FMODE_WRITE` on the volume node.\nUI:N - Exploitation needs only the attacker\u0027s own file I/O or ioctls against an already-mounted UBI/UBIFS volume; no victim action, mount of attacker-supplied media, or administrator interaction is required.\nS:U - The hang and the freed-slab-object corruption are confined to the kernel\u0027s own security authority on the affected host, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free on the `ubi_wl_entry_slab` object lets the attacker read fields (`e-\u003epnum`, `e-\u003eec`, rbtree links) out of memory that has been freed and can be reallocated with attacker-groomed content, giving a path to kernel memory disclosure.\nI:H - `rb_erase(\u0026e-\u003eu.rb, \u0026ubi-\u003eused)` and the subsequent `schedule_erase()` operate on the freed entry, writing rbtree pointer values through a dangling object and re-queuing it \u2014 a classic UAF write primitive usable for heap corruption and control-flow hijack.\nA:H - The `goto retry` loop never terminates, pinning a CPU at 100% in an unkillable kernel thread while holding `ubi-\u003efm_protect` and the LEB write lock, which permanently hangs all I/O to the UBI device and its UBIFS filesystems until reboot; the concurrent UAF independently causes kernel crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:14:17.891Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b40d2fbf47af58377e898b5062077a47bb28a132"
},
{
"url": "https://git.kernel.org/stable/c/f006f596fe851c3b6aae60b79f89f89f0e515d2f"
},
{
"url": "https://git.kernel.org/stable/c/b5be23f6ae610bdb262160a1f294afee6d0e6a69"
},
{
"url": "https://git.kernel.org/stable/c/8a18856e074479bd050b01e688c58defadce7ab0"
},
{
"url": "https://git.kernel.org/stable/c/3afaaf6f5867dc4ad383808d4053f428ec7b867d"
},
{
"url": "https://git.kernel.org/stable/c/cc4bc532acda66189bddc03b3fe1ad689d9a48a2"
},
{
"url": "https://git.kernel.org/stable/c/5af1c643184a5d09ff5b3f334077a4d0a163c677"
},
{
"url": "https://git.kernel.org/stable/c/4d57a7333e26040f2b583983e1970d9d460e56b0"
}
],
"title": "ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53481",
"datePublished": "2025-10-01T11:42:49.825Z",
"dateReserved": "2025-10-01T11:39:39.402Z",
"dateUpdated": "2026-10-15T21:41:28.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53481\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T21:34:44.820023Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T21:34:45.818Z\"}}], \"cna\": {\"title\": \"ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached only from local activity \\u2014 file writes/unlinks on a mounted UBIFS filesystem driving `ubifs_leb_unmap()`, or `UBI_IOCEBER`/`UBI_IOCEBUNMAP` ioctls on `/dev/ubiX_Y`. There is no network-facing consumer of the UBI wear-leveling layer.\\nAC:L - The attacker supplies both the concurrency (unbounded parallel LEB unmaps via ordinary filesystem writes/deletes or a tight ioctl loop) and sustained write pressure that keeps the wear-leveling worker running continuously on flash whose read/ECC errors are the expected operating condition UBI is built to handle; once the error path fires, the `NULL == ubi-\u003emove_from` comparison is deterministic, not probabilistic.\\nPR:L - Any unprivileged local user with write access to a UBIFS mount (the standard writable data/rootfs partition on embedded, automotive and IoT devices) can drive `ubi_eba_unmap_leb()` through the UBIFS journal and background thread; the direct ioctl path has no capability check either, only `FMODE_WRITE` on the volume node.\\nUI:N - Exploitation needs only the attacker\u0027s own file I/O or ioctls against an already-mounted UBI/UBIFS volume; no victim action, mount of attacker-supplied media, or administrator interaction is required.\\nS:U - The hang and the freed-slab-object corruption are confined to the kernel\u0027s own security authority on the affected host, with no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - The use-after-free on the `ubi_wl_entry_slab` object lets the attacker read fields (`e-\u003epnum`, `e-\u003eec`, rbtree links) out of memory that has been freed and can be reallocated with attacker-groomed content, giving a path to kernel memory disclosure.\\nI:H - `rb_erase(\u0026e-\u003eu.rb, \u0026ubi-\u003eused)` and the subsequent `schedule_erase()` operate on the freed entry, writing rbtree pointer values through a dangling object and re-queuing it \\u2014 a classic UAF write primitive usable for heap corruption and control-flow hijack.\\nA:H - The `goto retry` loop never terminates, pinning a CPU at 100% in an unkillable kernel thread while holding `ubi-\u003efm_protect` and the LEB write lock, which permanently hangs all I/O to the UBI device and its UBIFS filesystems until reboot; the concurrent UAF independently causes kernel crashes.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"43f9b25a9cdd7b177f77f026b1461abd1abbd174\", \"lessThan\": \"b40d2fbf47af58377e898b5062077a47bb28a132\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43f9b25a9cdd7b177f77f026b1461abd1abbd174\", \"lessThan\": \"f006f596fe851c3b6aae60b79f89f89f0e515d2f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43f9b25a9cdd7b177f77f026b1461abd1abbd174\", \"lessThan\": \"b5be23f6ae610bdb262160a1f294afee6d0e6a69\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43f9b25a9cdd7b177f77f026b1461abd1abbd174\", \"lessThan\": \"8a18856e074479bd050b01e688c58defadce7ab0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43f9b25a9cdd7b177f77f026b1461abd1abbd174\", \"lessThan\": \"3afaaf6f5867dc4ad383808d4053f428ec7b867d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43f9b25a9cdd7b177f77f026b1461abd1abbd174\", \"lessThan\": \"cc4bc532acda66189bddc03b3fe1ad689d9a48a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43f9b25a9cdd7b177f77f026b1461abd1abbd174\", \"lessThan\": \"5af1c643184a5d09ff5b3f334077a4d0a163c677\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43f9b25a9cdd7b177f77f026b1461abd1abbd174\", \"lessThan\": \"4d57a7333e26040f2b583983e1970d9d460e56b0\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/mtd/ubi/wl.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.25\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.25\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.308\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.276\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.235\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.173\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.100\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.2.*\"}, {\"status\": \"unaffected\", \"version\": \"6.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/mtd/ubi/wl.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b40d2fbf47af58377e898b5062077a47bb28a132\"}, {\"url\": \"https://git.kernel.org/stable/c/f006f596fe851c3b6aae60b79f89f89f0e515d2f\"}, {\"url\": \"https://git.kernel.org/stable/c/b5be23f6ae610bdb262160a1f294afee6d0e6a69\"}, {\"url\": \"https://git.kernel.org/stable/c/8a18856e074479bd050b01e688c58defadce7ab0\"}, {\"url\": \"https://git.kernel.org/stable/c/3afaaf6f5867dc4ad383808d4053f428ec7b867d\"}, {\"url\": \"https://git.kernel.org/stable/c/cc4bc532acda66189bddc03b3fe1ad689d9a48a2\"}, {\"url\": \"https://git.kernel.org/stable/c/5af1c643184a5d09ff5b3f334077a4d0a163c677\"}, {\"url\": \"https://git.kernel.org/stable/c/4d57a7333e26040f2b583983e1970d9d460e56b0\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed\\n\\nFollowing process will trigger an infinite loop in ubi_wl_put_peb():\\n\\n\\tubifs_bgt\\t\\tubi_bgt\\nubifs_leb_unmap\\n ubi_leb_unmap\\n ubi_eba_unmap_leb\\n ubi_wl_put_peb\\twear_leveling_worker\\n e1 = rb_entry(rb_first(\u0026ubi-\u003eused)\\n\\t\\t\\t e2 = get_peb_for_wl(ubi)\\n\\t\\t\\t ubi_io_read_vid_hdr // return err (flash fault)\\n\\t\\t\\t out_error:\\n\\t\\t\\t ubi-\u003emove_from = ubi-\u003emove_to = NULL\\n\\t\\t\\t wl_entry_destroy(ubi, e1)\\n\\t\\t\\t ubi-\u003elookuptbl[e-\u003epnum] = NULL\\n retry:\\n e = ubi-\u003elookuptbl[pnum];\\t// return NULL\\n\\tif (e == ubi-\u003emove_from) {\\t// NULL == NULL gets true\\n\\t goto retry;\\t\\t\\t// infinite loop !!!\\n\\n$ top\\n PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND\\n 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0\\n\\nFix it by:\\n 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has\\n been removed from \u0027ubi-\u003elookuptbl\u0027.\\n 2) Using \u0027ubi-\u003ewl_lock\u0027 protecting wl entry deletion to preventing an\\n use-after-free problem for wl entry in ubi_wl_put_peb().\\n\\nFetch a reproducer in [Link].\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.308\", \"versionStartIncluding\": \"2.6.25\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.276\", \"versionStartIncluding\": \"2.6.25\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.235\", \"versionStartIncluding\": \"2.6.25\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.173\", \"versionStartIncluding\": \"2.6.25\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.100\", \"versionStartIncluding\": \"2.6.25\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.18\", \"versionStartIncluding\": \"2.6.25\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2.5\", \"versionStartIncluding\": \"2.6.25\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.3\", \"versionStartIncluding\": \"2.6.25\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:14:17.891Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-53481\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-15T21:41:28.594Z\", \"dateReserved\": \"2025-10-01T11:39:39.402Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-01T11:42:49.825Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…