Cloudanix VulnDB

CVE-2023-54087

None

CVSS

—

EPSS

0.2%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel storage handling problem could cause systems to crash when an error occurs during volume setup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in ubi_free_volume() triggered when ubi_add_volume() fails at cdev_add(), causing kill_volumes() to attempt device_unregister on an incompletely registered device.

Why it matters to the business

Kernel instability or crashes on Linux systems using UBI for flash storage management, with low immediate risk given stable low EPSS and no known exploitation or ransomware use.

How an attack unfolds

An attacker with local access induces a failure in device registration during UBI volume addition, forcing the error path through kill_volumes into ubi_free_volume on a partially initialized structure and producing a null dereference crash.

How to fix it

Upgrade affected Linux kernel trees to commits containing the fix such as 5558bcf1c58720ca6e9d6198d921cb3aa337f038 or 2b6237f3baaa1d905c491fca29f8301835721c46.

How to confirm the fix worked

Confirm the fix commit is present in the kernel source tree; exercise ubi_add_volume error paths to verify no dereference occurs on failed device registration.

Typical attack path

  1. Obtain local execution context on target system
  2. Trigger UBI volume creation that causes cdev_add to fail
  3. Invoke error handling that calls ubi_free_volume without prior successful device addition

How to detect it

Inspect kernel logs for null pointer dereference messages referencing ubi_free_volume, ubi_add_volume, or device registration failures in the UBI subsystem.

What your security team should do

  • Apply the referenced kernel fixes promptly to all UBI-using systems
  • Monitor kernel logs for UBI-related oops or null dereference reports
  • Limit exposure by reviewing custom UBI volume management code for similar error handling issues

The record

In the Linux kernel, the following vulnerability has been resolved: ubi: Fix possible null-ptr-deref in ubi_free_volume() It willl cause null-ptr-deref in the following case: uif_init() ubi_add_volume() cdev_add() -> if it fails, call kill_volumes() device_register() kill_volumes() -> if ubi_add_volume() fails call this function ubi_free_volume() cdev_del() device_unregister() -> trying to delete a not added device, it causes null-ptr-deref So in ubi_free_volume(), it delete devices whether they are added or not, it will causes null-ptr-deref. Handle the error case whlie calling ubi_add_volume() to fix this problem. If add volume fails, set the corresponding vol to null, so it can not be accessed in kill_volumes() and release the resource in ubi_add_volume() error path.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 2.6.22 4.14.308

Related vulnerabilities