SB2025121065 - Use-after-free in Linux kernel mtd ubi driver
Published: December 10, 2025 Updated: December 12, 2025
Security Bulletin ID
SB2025121065
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2023-53826)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the wear_leveling_worker() and __erase_worker() functions in drivers/mtd/ubi/wl.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/1cb14c06d6035539ef4215c4ba0871aea71d7c38
- https://git.kernel.org/stable/c/3f9b63dfce44a7c3c095dd93d910408e07ab1845
- https://git.kernel.org/stable/c/79548ccdd992707879b4b683b7251c58ddf26f12
- https://git.kernel.org/stable/c/84250da1c63cb7d421a3b4812b5c2ce2e47d31a1
- https://git.kernel.org/stable/c/84253f3c2dad6be10d30c92626c763d9a9f512ad
- https://git.kernel.org/stable/c/9d448dd6bcb61a508204b57ea1f454ba9bac2f24
- https://git.kernel.org/stable/c/a100de2974d208cfca032179b02ed4d1a0a7f143
- https://git.kernel.org/stable/c/a240bc5c43130c6aa50831d7caaa02a1d84e1bce
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.308
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.276
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.173
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.100
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.235
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.18
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.5
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3