LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53826: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()

In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example: __erase_worker eraseblk_count_seq_show wl = ubi->lookuptbl[*block_number] if (wl) wl_entry_destroy ubi->lookuptbl[e->pnum] = NULL kmem_cache_free(ubi_wl_entry_slab, e) erase_count = wl->ec // UAF! Wear-leveling entry updating/accessing in ubi->lookuptbl should be protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize wl entry accessing between wl_entry_destroy() and eraseblk_count_seq_show(). Fetch a reproducer in [Link].

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel use-after-free bug in the UBI flash-storage subsystem. It involves unsafe access to a wear-leveling entry during erase-block reporting. The sources do not provide CVSS, proven business impact, or active exploitation evidence, so urgency depends on whether affected systems use UBI/MTD flash storage.

Executive priority

Handle as targeted kernel hygiene for embedded or flash-storage Linux estates, not a confirmed emergency. Prioritize internet-facing appliances and operational technology devices only if they run affected UBI-enabled kernels.

Technical view

The race is between wl_entry_destroy() freeing a UBI wear-leveling entry and eraseblk_count_seq_show() reading that entry from ubi->lookuptbl. The fix serializes lookup-table access with ubi->wl_lock. Source data lists Linux kernel versions as affected and provides multiple stable kernel commits.

Likely exposure

Most relevant to Linux systems using UBI, commonly embedded or flash-backed devices. Exposure is less likely on general-purpose servers that do not use UBI/MTD. The provided version data is broad and should be validated against the exact running kernel and vendor backports.

Exploitation context

The bundle states KEV is false and provides no cited evidence of active exploitation. It mentions a reproducer link, but no exploit status, impact class, or weaponized technique is included in the provided sources.

Researcher notes

The key primitive is a UAF read path caused by missing wl_lock coverage around ubi->lookuptbl access. The sources do not establish attacker prerequisites, impact beyond memory safety, or reliable exploitability. Treat any impact assessment beyond the race condition as unconfirmed.

Mitigation direction

  • Review vendor or distribution guidance for CVE-2023-53826.
  • Update affected Linux kernels to a build containing the referenced stable fixes.
  • Prioritize assets using UBI or MTD flash storage.
  • For appliances, request firmware status from the device vendor.
  • Track remediation separately for vendor-backported kernels.

Validation and detection

  • Inventory Linux assets and identify kernels using UBI or MTD.
  • Compare running kernel builds against vendor advisories and stable fix commits.
  • Check whether /proc or debug paths expose UBI erase-block reporting.
  • Confirm firmware images include the locking fix or vendor equivalent.
  • Document systems where UBI is absent as lower exposure.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53826 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707unaffected
LinuxLinux2.6.22, 0, 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.100, 6.1.18, 6.2.5, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.