CVE-2023-54087: ubi: Fix possible null-ptr-deref in ubi_free_volume()
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix possible null-ptr-deref in ubi_free_volume()
It willl cause null-ptr-deref in the following case:
uif_init()
ubi_add_volume()
cdev_add() -> if it fails, call kill_volumes()
device_register()
kill_volumes() -> if ubi_add_volume() fails call this function
ubi_free_volume()
cdev_del()
device_unregister() -> trying to delete a not added device,
it causes null-ptr-deref
So in ubi_free_volume(), it delete devices whether they are added
or not, it will causes null-ptr-deref.
Handle the error case whlie calling ubi_add_volume() to fix this
problem. If add volume fails, set the corresponding vol to null,
so it can not be accessed in kill_volumes() and release the
resource in ubi_add_volume() error path.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel reliability flaw in the UBI flash volume subsystem. In an error path, the kernel may try to unregister a device that was never successfully added, causing a null pointer dereference. The public bundle does not provide CVSS, attack requirements, or evidence of active exploitation.
Executive priority
Treat as a targeted kernel stability issue, not an emergency based on current evidence. Prioritize patching where UBI-backed devices support business-critical services or are difficult to recover after a kernel crash.
Technical view
The issue is in ubi_free_volume() handling after ubi_add_volume() fails. If cdev_add() fails and cleanup calls kill_volumes(), ubi_free_volume() can call device_unregister() on a not-added device. Stable kernel commits fix the error path by nulling the failed volume and releasing resources earlier.
Likely exposure
Most relevant to Linux systems using UBI/MTD flash volumes, commonly embedded or appliance-style deployments. General Linux servers without UBI usage are less likely to be exposed, but the bundle does not define runtime prerequisites or attack surface.
Exploitation context
The CVE source marks no KEV listing and provides no cited evidence of active exploitation. Available information supports a kernel crash/null-pointer risk in a specific error path, not confirmed remote code execution or public exploitation.
Researcher notes
Evidence is limited to the CVE record and Linux stable commit references. The bundle lacks CVSS, CWE, detailed affected-version ranges, attacker position, and exploitability analysis. Avoid assuming remote reachability or privilege requirements without vendor-specific advisories.
Mitigation direction
Apply Linux vendor kernel updates containing the referenced stable fixes.
Prioritize embedded, appliance, and flash-backed systems using UBI/MTD.
Check distribution advisories for exact fixed package versions.
If patching is delayed, reduce unnecessary UBI volume changes on critical systems.
Validation and detection
Inventory kernels and identify systems using UBI or MTD flash storage.
Compare deployed kernel versions against vendor fixed releases.
Confirm the kernel includes one of the referenced stable fix commits.
Review crash logs for UBI-related null pointer dereference events.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-54087 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
9Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Dec 24, 2025, 13:06 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.