CVE-2023-53826
published 2025-12-09CVE-2023-53826: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry could be…
PriorityP419low5.5
EPSS
0.25%
16.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Wear-leveling entry could be freed in error path, which may be accessed
again in eraseblk_count_seq_show(), for example:
__erase_worker eraseblk_count_seq_show
wl = ubi->lookuptbl[*block_number]
if (wl)
wl_entry_destroy
ubi->lookuptbl[e->pnum] = NULL
kmem_cache_free(ubi_wl_entry_slab, e)
erase_count = wl->ec // UAF!
Wear-leveling entry updating/accessing in ubi->lookuptbl should be
protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize
wl entry accessing between wl_entry_destroy() and
eraseblk_count_seq_show().
Fetch a reproducer in [Link].
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.20-1 (bookworm) | linux 6.1.20-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 801c135ce73d5df1caf3eca35b66a10824ae0707 < 3f9b63dfce44a7c3c095dd93d910408e07ab1845 | 3f9b63dfce44a7c3c095dd93d910408e07ab1845 |
| linux | linux | >= 801c135ce73d5df1caf3eca35b66a10824ae0707 < 84250da1c63cb7d421a3b4812b5c2ce2e47d31a1 | 84250da1c63cb7d421a3b4812b5c2ce2e47d31a1 |
| linux | linux | >= 801c135ce73d5df1caf3eca35b66a10824ae0707 < 1cb14c06d6035539ef4215c4ba0871aea71d7c38 | 1cb14c06d6035539ef4215c4ba0871aea71d7c38 |
| linux | linux | >= 801c135ce73d5df1caf3eca35b66a10824ae0707 < 9d448dd6bcb61a508204b57ea1f454ba9bac2f24 | 9d448dd6bcb61a508204b57ea1f454ba9bac2f24 |
| linux | linux | >= 801c135ce73d5df1caf3eca35b66a10824ae0707 < 79548ccdd992707879b4b683b7251c58ddf26f12 | 79548ccdd992707879b4b683b7251c58ddf26f12 |
| linux | linux | >= 801c135ce73d5df1caf3eca35b66a10824ae0707 < 84253f3c2dad6be10d30c92626c763d9a9f512ad | 84253f3c2dad6be10d30c92626c763d9a9f512ad |
| linux | linux | >= 801c135ce73d5df1caf3eca35b66a10824ae0707 < a100de2974d208cfca032179b02ed4d1a0a7f143 | a100de2974d208cfca032179b02ed4d1a0a7f143 |
| linux | linux | >= 801c135ce73d5df1caf3eca35b66a10824ae0707 < a240bc5c43130c6aa50831d7caaa02a1d84e1bce | a240bc5c43130c6aa50831d7caaa02a1d84e1bce |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 2.6.22 < 4.14.308 | 4.14.308 |
| linux | linux_kernel | >= 4.15.0 < 4.19.276 | 4.19.276 |
| linux | linux_kernel | >= 4.20.0 < 5.4.235 | 5.4.235 |
| linux | linux_kernel | >= 5.11.0 < 5.15.100 | 5.15.100 |
| linux | linux_kernel | >= 5.16.0 < 6.1.18 | 6.1.18 |
| linux | linux_kernel | >= 5.5.0 < 5.10.173 | 5.10.173 |
| linux | linux_kernel | >= 6.2.0 < 6.2.5 | 6.2.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-39w7-pr2v-3x67: In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Wear-leveling entr
ghsa_unreviewed·2025-12-09
CVE-2023-53826 GHSA-39w7-pr2v-3x67: In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Wear-leveling entr
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Wear-leveling entry could be freed in error path, which may be accessed
again in eraseblk_count_seq_show(), for example:
__erase_worker eraseblk_count_seq_show
wl = ubi->lookuptbl[*block_number]
if (wl)
wl_entry_destroy
ubi->lookuptbl[e->pnum] = NULL
kmem_cache_free(ubi_wl_entry_slab, e)
erase_count = wl->ec // UAF!
Wear-leveling entry updating/accessing in ubi->lookuptbl should be
protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize
wl entry accessing between wl_entry_destroy() and
eraseblk_count_seq_show().
Fetch a reproducer in [Link].
OSV
CVE-2023-53826: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry
osv·2025-12-09
CVE-2023-53826 CVE-2023-53826: In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example: __erase_worker eraseblk_count_seq_show wl = ubi->lookuptbl[*block_number] if (wl) wl_entry_destroy ubi->lookuptbl[e->pnum] = NULL kmem_cache_free(ubi_wl_entry_slab, e) erase_count = wl->ec // UAF! Wear-leveling entry updating/accessing in ubi->lookuptbl should be protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize wl entry accessing between wl_entry_destroy() and eraseblk_count_seq_show(). Fetch a reproducer in [Link].
OSV
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
osv·2025-12-09
CVE-2023-53826 ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Wear-leveling entry could be freed in error path, which may be accessed
again in eraseblk_count_seq_show(), for example:
__erase_worker eraseblk_count_seq_show
wl = ubi->lookuptbl[*block_number]
if (wl)
wl_entry_destroy
ubi->lookuptbl[e->pnum] = NULL
kmem_cache_free(ubi_wl_entry_slab, e)
erase_count = wl->ec // UAF!
Wear-leveling entry updating/accessing in ubi->lookuptbl should be
protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize
wl entry accessing between wl_entry_destroy() and
eraseblk_count_seq_show().
Fetch a reproducer in [Link].
Red Hat
kernel: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
vendor_redhat·2025-12-09·CVSS 5.5
CVE-2023-53826 [LOW] CWE-825 kernel: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
kernel: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Wear-leveling entry could be freed in error path, which may be accessed
again in eraseblk_count_seq_show(), for example:
__erase_worker eraseblk_count_seq_show
wl = ubi->lookuptbl[*block_number]
if (wl)
wl_entry_destroy
ubi->lookuptbl[e->pnum] = NULL
kmem_cache_free(ubi_wl_entry_slab, e)
erase_count = wl->ec // UAF!
Wear-leveling entry updating/accessing in ubi->lookuptbl should be
protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize
wl entry accessing between wl_entry_destroy() and
eraseblk_count_seq_show().
Fetch a reproducer in [Link].
A use-after-free vulnerability was f
Debian
CVE-2023-53826: linux - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UA...
vendor_debian·2023
CVE-2023-53826 CVE-2023-53826: linux - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UA...
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example: __erase_worker eraseblk_count_seq_show wl = ubi->lookuptbl[*block_number] if (wl) wl_entry_destroy ubi->lookuptbl[e->pnum] = NULL kmem_cache_free(ubi_wl_entry_slab, e) erase_count = wl->ec // UAF! Wear-leveling entry updating/accessing in ubi->lookuptbl should be protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize wl entry accessing between wl_entry_destroy() and eraseblk_count_seq_show(). Fetch a reproducer in [Link].
Scope: local
bookworm: resolved (fixed in 6.1.20-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved
No detection rules found.
No public exploits indexed.
Wiz
CVE-2023-53826 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-53826 CVE-2023-53826 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-53826 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Wear-leveling entry could be freed in error path, which may be accessed
again in eraseblk_count_seq_show(), for example:
__erase_worker eraseblk_count_seq_show
wl = ubi->lookuptbl[*block_number]
if (wl)
wl_entry_destroy
ubi->lookuptbl[e->pnum] = NULL
kmem_cache_free(ubi_wl_entry_slab, e)
erase_count = wl->ec // UAF!
Wear-leveling entry updating/accessing in ubi->lookuptbl should be
protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize
wl entry accessing between wl_entry_destroy() and
eraseblk_count_seq_show().
Fetch a reproducer in [Link].
Source : NVD
Published Decem
Bugzilla
CVE-2023-53826 kernel: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
bugzilla·2025-12-09
CVE-2023-53826 [LOW] CVE-2023-53826 kernel: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
CVE-2023-53826 kernel: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Wear-leveling entry could be freed in error path, which may be accessed
again in eraseblk_count_seq_show(), for example:
__erase_worker eraseblk_count_seq_show
wl = ubi->lookuptbl[*block_number]
if (wl)
wl_entry_destroy
ubi->lookuptbl[e->pnum] = NULL
kmem_cache_free(ubi_wl_entry_slab, e)
erase_count = wl->ec // UAF!
Wear-leveling entry updating/accessing in ubi->lookuptbl should be
protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize
wl entry accessing between wl_entry_destroy() and
eraseblk_count_seq_show().
Fetch a reproducer in [Link].
Discussion:
Ups
https://git.kernel.org/stable/c/1cb14c06d6035539ef4215c4ba0871aea71d7c38https://git.kernel.org/stable/c/3f9b63dfce44a7c3c095dd93d910408e07ab1845https://git.kernel.org/stable/c/79548ccdd992707879b4b683b7251c58ddf26f12https://git.kernel.org/stable/c/84250da1c63cb7d421a3b4812b5c2ce2e47d31a1https://git.kernel.org/stable/c/84253f3c2dad6be10d30c92626c763d9a9f512adhttps://git.kernel.org/stable/c/9d448dd6bcb61a508204b57ea1f454ba9bac2f24https://git.kernel.org/stable/c/a100de2974d208cfca032179b02ed4d1a0a7f143https://git.kernel.org/stable/c/a240bc5c43130c6aa50831d7caaa02a1d84e1bce
2025-12-09
Published