CVE-2023-53826

Not scored yetLast modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()

Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example:

__erase_worker eraseblk_count_seq_show wl = ubi->lookuptbl[*block_number] if (wl) wl_entry_destroy ubi->lookuptbl[e->pnum] = NULL kmem_cache_free(ubi_wl_entry_slab, e) erase_count = wl->ec // UAF!

Wear-leveling entry updating/accessing in ubi->lookuptbl should be protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize wl entry accessing between wl_entry_destroy() and eraseblk_count_seq_show().

Fetch a reproducer in [Link].

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
LinuxLinux>= 801c135ce73d5df1caf3eca35b66a10824ae0707, < 3f9b63dfce44a7c3c095dd93d910408e07ab1845; >= 801c135ce73d5df1caf3eca35b66a10824ae0707, < 84250da1c63cb7d421a3b4812b5c2ce2e47d31a1; >= 801c135ce73d5df1caf3eca35b66a10824ae0707, < 1cb14c06d6035539ef4215c4ba0871aea71d7c38; >= 801c135ce73d5df1caf3eca35b66a10824ae0707, < 9d448dd6bcb61a508204b57ea1f454ba9bac2f24; >= 801c135ce73d5df1caf3eca35b66a10824ae0707, < 79548ccdd992707879b4b683b7251c58ddf26f12; >= 801c135ce73d5df1caf3eca35b66a10824ae0707, < 84253f3c2dad6be10d30c92626c763d9a9f512ad; >= 801c135ce73d5df1caf3eca35b66a10824ae0707, < a100de2974d208cfca032179b02ed4d1a0a7f143; >= 801c135ce73d5df1caf3eca35b66a10824ae0707, < a240bc5c43130c6aa50831d7caaa02a1d84e1bce
LinuxLinux2.6.22

References

Timeline

Published
Dec 9, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-538278.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} SimCVE-2023-538287.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitoCVE-2023-538297.8In the Linux kernel, the following vulnerability has been resolved: f2fs: flush inode if atomic file is aborted Let's flush the inode beinCVE-2023-53834.3The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to CVE-2023-53830In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leak when showing current settings CVE-2023-53831In the Linux kernel, the following vulnerability has been resolved: net: read sk->sk_family once in sk_mc_loop() syzbot is playing with IPCVE-2023-53832In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null-ptr-deref in raid10_sync_request init_resync() iniCVE-2023-53833In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_gCVE-2023-53834In the Linux kernel, the following vulnerability has been resolved: iio: adc: ina2xx: avoid NULL pointer dereference on OF device match ThCVE-2023-538367.8In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skb refcnt race after locking changes There is a racCVE-2023-53837In the Linux kernel, the following vulnerability has been resolved: drm/msm: fix NULL-deref on snapshot tear down In case of early initialCVE-2023-538387.8In the Linux kernel, the following vulnerability has been resolved: f2fs: synchronize atomic write aborts To fix a race condition between
CVE-2023-53826: Unscored | Vulnix