High 7.8Published Oct 1, 2025

CVE-2023-53481ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed

Updated under an hour ago (Oct 28, 2026, 4:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed Following process will trigger an infinite loop in ubi_wl_put_peb(): ubifs_bgt ubi_bgt ubifs_leb_unmap ubi_leb_unmap ubi_eba_unmap_leb ubi_wl_put_peb wear_leveling_worker e1 = rb_entry(rb_first(&ubi->used) e2 = get_peb_for_wl(ubi) ubi_io_read_vid_hdr // return err (flash fault) out_error: ubi->move_from = ubi->move_to = NULL wl_entry_destroy(ubi, e1) ubi->lookuptbl[e->pnum] = NULL retry: e = ubi->lookuptbl[pnum]; // return NULL if (e == ubi->move_from) { // NULL == NULL gets true goto retry; // infinite loop !!! $ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0 Fix it by: 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has been removed from 'ubi->lookuptbl'. 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubi_wl_put_peb(). Fetch a reproducer in [Link].

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 43f9b25a9cdd7b177f77f026b1461abd1abbd174 before b40d2fbf47af58377e898b5062077a47bb28a132; from 43f9b25a9cdd7b177f77f026b1461abd1abbd174 before f006f596fe851c3b6aae60b79f89f89f0e515d2f; from 43f9b25a9cdd7b177f77f026b1461abd1abbd174 before b5be23f6ae610bdb262160a1f294afee6d0e6a69; 43f9b25a9cdd7b177f77f026b1461abd1abbd174 builds before 8a18856e074479bd050b01e688c58defadce7ab0; 43f9b25a9cdd7b177f77f026b1461abd1abbd174 builds before 3afaaf6f5867dc4ad383808d4053f428ec7b867d; from 43f9b25a9cdd7b177f77f026b1461abd1abbd174 before cc4bc532acda66189bddc03b3fe1ad689d9a48a2; 43f9b25a9cdd7b177f77f026b1461abd1abbd174 builds before 5af1c643184a5d09ff5b3f334077a4d0a163c677; 43f9b25a9cdd7b177f77f026b1461abd1abbd174 builds before 4d57a7333e26040f2b583983e1970d9d460e56b0	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.25 before 4.14.308; from 4.15 before 4.19.276; from 4.20 before 5.4.235; from 5.5 before 5.10.173; from 5.11 before 5.15.100; from 5.16 before 6.1.18; from 6.2 before 6.2.5	NVD

References

References

https://git.kernel.org/stable/c/b40d2fbf47af58377e898b5062077a47bb28a132	patch
https://git.kernel.org/stable/c/f006f596fe851c3b6aae60b79f89f89f0e515d2f	patch
https://git.kernel.org/stable/c/b5be23f6ae610bdb262160a1f294afee6d0e6a69	patch
https://git.kernel.org/stable/c/8a18856e074479bd050b01e688c58defadce7ab0	patch
https://git.kernel.org/stable/c/3afaaf6f5867dc4ad383808d4053f428ec7b867d	patch
https://git.kernel.org/stable/c/cc4bc532acda66189bddc03b3fe1ad689d9a48a2	patch
https://git.kernel.org/stable/c/5af1c643184a5d09ff5b3f334077a4d0a163c677	patch
https://git.kernel.org/stable/c/4d57a7333e26040f2b583983e1970d9d460e56b0	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.