CVE-2023-53481 (GCVE-0-2023-53481)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:42 – Updated: 2026-08-05 09:14
VLAI
Title
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
Summary
In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed Following process will trigger an infinite loop in ubi_wl_put_peb(): ubifs_bgt ubi_bgt ubifs_leb_unmap ubi_leb_unmap ubi_eba_unmap_leb ubi_wl_put_peb wear_leveling_worker e1 = rb_entry(rb_first(&ubi->used) e2 = get_peb_for_wl(ubi) ubi_io_read_vid_hdr // return err (flash fault) out_error: ubi->move_from = ubi->move_to = NULL wl_entry_destroy(ubi, e1) ubi->lookuptbl[e->pnum] = NULL retry: e = ubi->lookuptbl[pnum]; // return NULL if (e == ubi->move_from) { // NULL == NULL gets true goto retry; // infinite loop !!! $ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0 Fix it by: 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has been removed from 'ubi->lookuptbl'. 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubi_wl_put_peb(). Fetch a reproducer in [Link].
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 , < b40d2fbf47af58377e898b5062077a47bb28a132 (git)
Affected: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 , < f006f596fe851c3b6aae60b79f89f89f0e515d2f (git)
Affected: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 , < b5be23f6ae610bdb262160a1f294afee6d0e6a69 (git)
Affected: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 , < 8a18856e074479bd050b01e688c58defadce7ab0 (git)
Affected: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 , < 3afaaf6f5867dc4ad383808d4053f428ec7b867d (git)
Affected: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 , < cc4bc532acda66189bddc03b3fe1ad689d9a48a2 (git)
Affected: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 , < 5af1c643184a5d09ff5b3f334077a4d0a163c677 (git)
Affected: 43f9b25a9cdd7b177f77f026b1461abd1abbd174 , < 4d57a7333e26040f2b583983e1970d9d460e56b0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.25
Unaffected: 0 , < 2.6.25 (semver)
Unaffected: 4.14.308 , ≤ 4.14.* (semver)
Unaffected: 4.19.276 , ≤ 4.19.* (semver)
Unaffected: 5.4.235 , ≤ 5.4.* (semver)
Unaffected: 5.10.173 , ≤ 5.10.* (semver)
Unaffected: 5.15.100 , ≤ 5.15.* (semver)
Unaffected: 6.1.18 , ≤ 6.1.* (semver)
Unaffected: 6.2.5 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/ubi/wl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b40d2fbf47af58377e898b5062077a47bb28a132",
              "status": "affected",
              "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
              "versionType": "git"
            },
            {
              "lessThan": "f006f596fe851c3b6aae60b79f89f89f0e515d2f",
              "status": "affected",
              "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
              "versionType": "git"
            },
            {
              "lessThan": "b5be23f6ae610bdb262160a1f294afee6d0e6a69",
              "status": "affected",
              "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
              "versionType": "git"
            },
            {
              "lessThan": "8a18856e074479bd050b01e688c58defadce7ab0",
              "status": "affected",
              "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
              "versionType": "git"
            },
            {
              "lessThan": "3afaaf6f5867dc4ad383808d4053f428ec7b867d",
              "status": "affected",
              "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
              "versionType": "git"
            },
            {
              "lessThan": "cc4bc532acda66189bddc03b3fe1ad689d9a48a2",
              "status": "affected",
              "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
              "versionType": "git"
            },
            {
              "lessThan": "5af1c643184a5d09ff5b3f334077a4d0a163c677",
              "status": "affected",
              "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
              "versionType": "git"
            },
            {
              "lessThan": "4d57a7333e26040f2b583983e1970d9d460e56b0",
              "status": "affected",
              "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/ubi/wl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.308",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.308",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.276",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.235",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.173",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.100",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.18",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.5",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed\n\nFollowing process will trigger an infinite loop in ubi_wl_put_peb():\n\n\tubifs_bgt\t\tubi_bgt\nubifs_leb_unmap\n  ubi_leb_unmap\n    ubi_eba_unmap_leb\n      ubi_wl_put_peb\twear_leveling_worker\n                          e1 = rb_entry(rb_first(\u0026ubi-\u003eused)\n\t\t\t  e2 = get_peb_for_wl(ubi)\n\t\t\t  ubi_io_read_vid_hdr  // return err (flash fault)\n\t\t\t  out_error:\n\t\t\t    ubi-\u003emove_from = ubi-\u003emove_to = NULL\n\t\t\t    wl_entry_destroy(ubi, e1)\n\t\t\t      ubi-\u003elookuptbl[e-\u003epnum] = NULL\n      retry:\n        e = ubi-\u003elookuptbl[pnum];\t// return NULL\n\tif (e == ubi-\u003emove_from) {\t// NULL == NULL gets true\n\t  goto retry;\t\t\t// infinite loop !!!\n\n$ top\n  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     COMMAND\n  7676 root     20   0       0      0      0 R 100.0  0.0  ubifs_bgt0_0\n\nFix it by:\n 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has\n    been removed from \u0027ubi-\u003elookuptbl\u0027.\n 2) Using \u0027ubi-\u003ewl_lock\u0027 protecting wl entry deletion to preventing an\n    use-after-free problem for wl entry in ubi_wl_put_peb().\n\nFetch a reproducer in [Link]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only from local activity \u2014 file writes/unlinks on a mounted UBIFS filesystem driving `ubifs_leb_unmap()`, or `UBI_IOCEBER`/`UBI_IOCEBUNMAP` ioctls on `/dev/ubiX_Y`. There is no network-facing consumer of the UBI wear-leveling layer.\nAC:L - The attacker supplies both the concurrency (unbounded parallel LEB unmaps via ordinary filesystem writes/deletes or a tight ioctl loop) and sustained write pressure that keeps the wear-leveling worker running continuously on flash whose read/ECC errors are the expected operating condition UBI is built to handle; once the error path fires, the `NULL == ubi-\u003emove_from` comparison is deterministic, not probabilistic.\nPR:L - Any unprivileged local user with write access to a UBIFS mount (the standard writable data/rootfs partition on embedded, automotive and IoT devices) can drive `ubi_eba_unmap_leb()` through the UBIFS journal and background thread; the direct ioctl path has no capability check either, only `FMODE_WRITE` on the volume node.\nUI:N - Exploitation needs only the attacker\u0027s own file I/O or ioctls against an already-mounted UBI/UBIFS volume; no victim action, mount of attacker-supplied media, or administrator interaction is required.\nS:U - The hang and the freed-slab-object corruption are confined to the kernel\u0027s own security authority on the affected host, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free on the `ubi_wl_entry_slab` object lets the attacker read fields (`e-\u003epnum`, `e-\u003eec`, rbtree links) out of memory that has been freed and can be reallocated with attacker-groomed content, giving a path to kernel memory disclosure.\nI:H - `rb_erase(\u0026e-\u003eu.rb, \u0026ubi-\u003eused)` and the subsequent `schedule_erase()` operate on the freed entry, writing rbtree pointer values through a dangling object and re-queuing it \u2014 a classic UAF write primitive usable for heap corruption and control-flow hijack.\nA:H - The `goto retry` loop never terminates, pinning a CPU at 100% in an unkillable kernel thread while holding `ubi-\u003efm_protect` and the LEB write lock, which permanently hangs all I/O to the UBI device and its UBIFS filesystems until reboot; the concurrent UAF independently causes kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:17.891Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b40d2fbf47af58377e898b5062077a47bb28a132"
        },
        {
          "url": "https://git.kernel.org/stable/c/f006f596fe851c3b6aae60b79f89f89f0e515d2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5be23f6ae610bdb262160a1f294afee6d0e6a69"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a18856e074479bd050b01e688c58defadce7ab0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3afaaf6f5867dc4ad383808d4053f428ec7b867d"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc4bc532acda66189bddc03b3fe1ad689d9a48a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5af1c643184a5d09ff5b3f334077a4d0a163c677"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d57a7333e26040f2b583983e1970d9d460e56b0"
        }
      ],
      "title": "ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53481",
    "datePublished": "2025-10-01T11:42:49.825Z",
    "dateReserved": "2025-10-01T11:39:39.402Z",
    "dateUpdated": "2026-08-05T09:14:17.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53481",
      "date": "2026-09-26",
      "epss": "0.0016",
      "percentile": "0.04445"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mtd/ubi/wl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b40d2fbf47af58377e898b5062077a47bb28a132",
                    "status": "affected",
                    "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f006f596fe851c3b6aae60b79f89f89f0e515d2f",
                    "status": "affected",
                    "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b5be23f6ae610bdb262160a1f294afee6d0e6a69",
                    "status": "affected",
                    "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a18856e074479bd050b01e688c58defadce7ab0",
                    "status": "affected",
                    "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3afaaf6f5867dc4ad383808d4053f428ec7b867d",
                    "status": "affected",
                    "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cc4bc532acda66189bddc03b3fe1ad689d9a48a2",
                    "status": "affected",
                    "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5af1c643184a5d09ff5b3f334077a4d0a163c677",
                    "status": "affected",
                    "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4d57a7333e26040f2b583983e1970d9d460e56b0",
                    "status": "affected",
                    "version": "43f9b25a9cdd7b177f77f026b1461abd1abbd174",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mtd/ubi/wl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.25"
                  },
                  {
                    "lessThan": "2.6.25",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.308",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.276",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.235",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.173",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.100",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3619A302-E12E-46AC-B1E4-182D5643C493",
                    "versionEndExcluding": "4.14.308",
                    "versionStartIncluding": "2.6.25",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C902FC54-DDBD-4DA6-BFEF-26889A267464",
                    "versionEndExcluding": "4.19.276",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "13DD5E68-8CB4-46EE-9A8F-C7F6C1A84430",
                    "versionEndExcluding": "5.4.235",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4D810CFB-B7C5-493C-B98A-0D5F0D8A47B6",
                    "versionEndExcluding": "5.10.173",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D7E5BB5-018B-46B7-A2C4-1ADB75099822",
                    "versionEndExcluding": "5.15.100",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C8D24FD5-5A98-4042-9419-39DCFCBEFFF5",
                    "versionEndExcluding": "6.1.18",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0575B33B-A320-4E51-84CA-10C937341E02",
                    "versionEndExcluding": "6.2.5",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed\n\nFollowing process will trigger an infinite loop in ubi_wl_put_peb():\n\n\tubifs_bgt\t\tubi_bgt\nubifs_leb_unmap\n  ubi_leb_unmap\n    ubi_eba_unmap_leb\n      ubi_wl_put_peb\twear_leveling_worker\n                          e1 = rb_entry(rb_first(\u0026ubi-\u003eused)\n\t\t\t  e2 = get_peb_for_wl(ubi)\n\t\t\t  ubi_io_read_vid_hdr  // return err (flash fault)\n\t\t\t  out_error:\n\t\t\t    ubi-\u003emove_from = ubi-\u003emove_to = NULL\n\t\t\t    wl_entry_destroy(ubi, e1)\n\t\t\t      ubi-\u003elookuptbl[e-\u003epnum] = NULL\n      retry:\n        e = ubi-\u003elookuptbl[pnum];\t// return NULL\n\tif (e == ubi-\u003emove_from) {\t// NULL == NULL gets true\n\t  goto retry;\t\t\t// infinite loop !!!\n\n$ top\n  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     COMMAND\n  7676 root     20   0       0      0      0 R 100.0  0.0  ubifs_bgt0_0\n\nFix it by:\n 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has\n    been removed from \u0027ubi-\u003elookuptbl\u0027.\n 2) Using \u0027ubi-\u003ewl_lock\u0027 protecting wl entry deletion to preventing an\n    use-after-free problem for wl entry in ubi_wl_put_peb().\n\nFetch a reproducer in [Link]."
          }
        ],
        "id": "CVE-2023-53481",
        "lastModified": "2026-08-04T10:19:08.113",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-01T12:15:50.743",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3afaaf6f5867dc4ad383808d4053f428ec7b867d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4d57a7333e26040f2b583983e1970d9d460e56b0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5af1c643184a5d09ff5b3f334077a4d0a163c677"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8a18856e074479bd050b01e688c58defadce7ab0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b40d2fbf47af58377e898b5062077a47bb28a132"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b5be23f6ae610bdb262160a1f294afee6d0e6a69"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cc4bc532acda66189bddc03b3fe1ad689d9a48a2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f006f596fe851c3b6aae60b79f89f89f0e515d2f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-835"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:20:12+00:00",
      "cve": "CVE-2023-53481",
      "id": "CVE-2023-53481",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53481.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T17:02:44Z",
      "cve": "CVE-2023-53481",
      "id": "CVE-2023-53481",
      "initial_release_date": "2025-10-02T23:58:12Z",
      "product_status:known_affected": "8",
      "product_status:known_not_affected": "515",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53481",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53481.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.