LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54087: ubi: Fix possible null-ptr-deref in ubi_free_volume()

In the Linux kernel, the following vulnerability has been resolved: ubi: Fix possible null-ptr-deref in ubi_free_volume() It willl cause null-ptr-deref in the following case: uif_init() ubi_add_volume() cdev_add() -> if it fails, call kill_volumes() device_register() kill_volumes() -> if ubi_add_volume() fails call this function ubi_free_volume() cdev_del() device_unregister() -> trying to delete a not added device, it causes null-ptr-deref So in ubi_free_volume(), it delete devices whether they are added or not, it will causes null-ptr-deref. Handle the error case whlie calling ubi_add_volume() to fix this problem. If add volume fails, set the corresponding vol to null, so it can not be accessed in kill_volumes() and release the resource in ubi_add_volume() error path.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability flaw in the UBI flash volume subsystem. In an error path, the kernel may try to unregister a device that was never successfully added, causing a null pointer dereference. The public bundle does not provide CVSS, attack requirements, or evidence of active exploitation.

Executive priority

Treat as a targeted kernel stability issue, not an emergency based on current evidence. Prioritize patching where UBI-backed devices support business-critical services or are difficult to recover after a kernel crash.

Technical view

The issue is in ubi_free_volume() handling after ubi_add_volume() fails. If cdev_add() fails and cleanup calls kill_volumes(), ubi_free_volume() can call device_unregister() on a not-added device. Stable kernel commits fix the error path by nulling the failed volume and releasing resources earlier.

Likely exposure

Most relevant to Linux systems using UBI/MTD flash volumes, commonly embedded or appliance-style deployments. General Linux servers without UBI usage are less likely to be exposed, but the bundle does not define runtime prerequisites or attack surface.

Exploitation context

The CVE source marks no KEV listing and provides no cited evidence of active exploitation. Available information supports a kernel crash/null-pointer risk in a specific error path, not confirmed remote code execution or public exploitation.

Researcher notes

Evidence is limited to the CVE record and Linux stable commit references. The bundle lacks CVSS, CWE, detailed affected-version ranges, attacker position, and exploitability analysis. Avoid assuming remote reachability or privilege requirements without vendor-specific advisories.

Mitigation direction

  • Apply Linux vendor kernel updates containing the referenced stable fixes.
  • Prioritize embedded, appliance, and flash-backed systems using UBI/MTD.
  • Check distribution advisories for exact fixed package versions.
  • If patching is delayed, reduce unnecessary UBI volume changes on critical systems.

Validation and detection

  • Inventory kernels and identify systems using UBI or MTD flash storage.
  • Compare deployed kernel versions against vendor fixed releases.
  • Confirm the kernel includes one of the referenced stable fix commits.
  • Review crash logs for UBI-related null pointer dereference events.
Prepared
Confidence
medium
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54087 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707, 801c135ce73d5df1caf3eca35b66a10824ae0707unaffected
LinuxLinux2.6.22, 0, 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.100, 6.1.18, 6.2.5, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.