CVE-2023-53800 (GCVE-0-2023-53800)

Vulnerability from cvelistv5 – Published: 2025-12-09 00:00 – Updated: 2026-08-05 09:16
VLAI
Title
ubi: Fix use-after-free when volume resizing failed
Summary
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume resizing failed There is an use-after-free problem reported by KASAN: ================================================================== BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2 PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi] ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record() returns an error in ubi_resize_volume(), "new_eba_tbl" will be freed on error handing path, but it is holded by "vol->eba_tbl" in ubi_eba_replace_table(). It means that the liftcycle of "vol->eba_tbl" and "vol" are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by not freeing "new_eba_tbl" after it replaced in ubi_eba_replace_table(), while will be freed in next volume resizing.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 801c135ce73d5df1caf3eca35b66a10824ae0707 , < bf9875aa7f7d624a8c084425b14bf7e5907ebc30 (git)
Affected: 801c135ce73d5df1caf3eca35b66a10824ae0707 , < bf795ebbb9995e2fe7945de71177f01c2f1215dc (git)
Affected: 801c135ce73d5df1caf3eca35b66a10824ae0707 , < 9c8be1f165baee53b5a36ea0b3c9281d403a1d0b (git)
Affected: 801c135ce73d5df1caf3eca35b66a10824ae0707 , < 35f8d4064e54c18424db2997059d4c0b1d13d093 (git)
Affected: 801c135ce73d5df1caf3eca35b66a10824ae0707 , < 53818746e549e61841428892a8d94344494be797 (git)
Affected: 801c135ce73d5df1caf3eca35b66a10824ae0707 , < b0c951742348d216f094d16ed4f70ae73db881c0 (git)
Affected: 801c135ce73d5df1caf3eca35b66a10824ae0707 , < 3d6378f7056ac7350338f941001162a8f660853c (git)
Affected: 801c135ce73d5df1caf3eca35b66a10824ae0707 , < 9af31d6ec1a4be4caab2550096c6bd2ba8fba472 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.22
Unaffected: 0 , < 2.6.22 (semver)
Unaffected: 4.14.308 , ≤ 4.14.* (semver)
Unaffected: 4.19.276 , ≤ 4.19.* (semver)
Unaffected: 5.4.235 , ≤ 5.4.* (semver)
Unaffected: 5.10.173 , ≤ 5.10.* (semver)
Unaffected: 5.15.100 , ≤ 5.15.* (semver)
Unaffected: 6.1.18 , ≤ 6.1.* (semver)
Unaffected: 6.2.5 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/ubi/vmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf9875aa7f7d624a8c084425b14bf7e5907ebc30",
              "status": "affected",
              "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
              "versionType": "git"
            },
            {
              "lessThan": "bf795ebbb9995e2fe7945de71177f01c2f1215dc",
              "status": "affected",
              "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
              "versionType": "git"
            },
            {
              "lessThan": "9c8be1f165baee53b5a36ea0b3c9281d403a1d0b",
              "status": "affected",
              "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
              "versionType": "git"
            },
            {
              "lessThan": "35f8d4064e54c18424db2997059d4c0b1d13d093",
              "status": "affected",
              "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
              "versionType": "git"
            },
            {
              "lessThan": "53818746e549e61841428892a8d94344494be797",
              "status": "affected",
              "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
              "versionType": "git"
            },
            {
              "lessThan": "b0c951742348d216f094d16ed4f70ae73db881c0",
              "status": "affected",
              "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
              "versionType": "git"
            },
            {
              "lessThan": "3d6378f7056ac7350338f941001162a8f660853c",
              "status": "affected",
              "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
              "versionType": "git"
            },
            {
              "lessThan": "9af31d6ec1a4be4caab2550096c6bd2ba8fba472",
              "status": "affected",
              "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/ubi/vmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.308",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.308",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.276",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.235",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.173",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.100",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.18",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.5",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: Fix use-after-free when volume resizing failed\n\nThere is an use-after-free problem reported by KASAN:\n  ==================================================================\n  BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi]\n  Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735\n\n  CPU: 2 PID: 4735 Comm: ubirsvol\n  Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n  BIOS 1.14.0-1.fc33 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x34/0x44\n   print_report+0x171/0x472\n   kasan_report+0xad/0x130\n   ubi_eba_copy_table+0x11f/0x1c0 [ubi]\n   ubi_resize_volume+0x4f9/0xbc0 [ubi]\n   ubi_cdev_ioctl+0x701/0x1850 [ubi]\n   __x64_sys_ioctl+0x11d/0x170\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n   \u003c/TASK\u003e\n\nWhen ubi_change_vtbl_record() returns an error in ubi_resize_volume(),\n\"new_eba_tbl\" will be freed on error handing path, but it is holded\nby \"vol-\u003eeba_tbl\" in ubi_eba_replace_table(). It means that the liftcycle\nof \"vol-\u003eeba_tbl\" and \"vol\" are different, so when resizing volume in\nnext time, it causing an use-after-free fault.\n\nFix it by not freeing \"new_eba_tbl\" after it replaced in\nubi_eba_replace_table(), while will be freed in next volume resizing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through `ioctl(UBI_IOCRSVOL)` on the local `/dev/ubiN` character device (`ubi_cdev_ioctl`, cdev.c:972), or via autoresize at device attach. There is no network- or adjacent-reachable path into `ubi_resize_volume()`.\nAC:L - The failing step is attacker-inducible without hardware faults \u2014 `ubi_change_vtbl_record()` propagates `-ENOMEM` from the `GFP_NOFS` allocations in `ubi_eba_atomic_leb_change()` and `ltree_add_entry()`, which memory pressure reliably defeats, and the ioctl can simply be retried until one attempt fails. The resulting dangling `vol-\u003eeba_tbl` persists indefinitely, so the attacker has an unbounded window to groom the kmalloc-8/16 slab before firing the read/write.\nPR:L - The path is gated by `capable(CAP_SYS_RESOURCE)`, a single narrow capability commonly delegated to non-root storage/service accounts on the embedded and IoT systems where UBI is deployed, far short of full administrative control of the system. This matches the CISA-ADP scoring of PR:L for the identical sibling bugs CVE-2022-49388 and CVE-2021-47634 in the same UBI cdev ioctl paths.\nUI:N - The attacker performs the resize ioctl, the memory-pressure setup, the heap spray and the subsequent LEB operation entirely on their own. No victim action or interaction is required at any point.\nS:U - The freed object and all corruption sites lie within the kernel\u0027s own memory and security authority; there is no VM, IOMMU, or sandbox boundary crossed. Exploitation yields kernel privilege escalation within the same authority.\nC:H - Once the freed 8-byte table is reclaimed with sprayed data, the attacker controls the `entries` pointer, and read sites such as `eba.c:108/458/603/953/1026` dereference `entries[lnum].pnum` with an attacker-chosen `lnum`, yielding an arbitrary kernel-memory read primitive.\nI:H - The write sites `vol-\u003eeba_tbl-\u003eentries[lnum].pnum = pnum` (eba.c:466, 528, 862, 975, 1464) become a controlled 4-byte write at an attacker-chosen kernel address once the freed slot is reclaimed, sufficient for control-flow hijack and privilege escalation.\nA:H - Even unexploited, the dangling `vol-\u003eeba_tbl` is dereferenced by every subsequent LEB operation, by the background wear-leveling worker (`ubi_eba_copy_leb`), and by any UBIFS/ubiblock stacked on the volume, producing kernel oops/panic as shown in the KASAN report in the fix commit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:05.119Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf9875aa7f7d624a8c084425b14bf7e5907ebc30"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf795ebbb9995e2fe7945de71177f01c2f1215dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c8be1f165baee53b5a36ea0b3c9281d403a1d0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f8d4064e54c18424db2997059d4c0b1d13d093"
        },
        {
          "url": "https://git.kernel.org/stable/c/53818746e549e61841428892a8d94344494be797"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0c951742348d216f094d16ed4f70ae73db881c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d6378f7056ac7350338f941001162a8f660853c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9af31d6ec1a4be4caab2550096c6bd2ba8fba472"
        }
      ],
      "title": "ubi: Fix use-after-free when volume resizing failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53800",
    "datePublished": "2025-12-09T00:00:56.507Z",
    "dateReserved": "2025-12-08T23:58:35.275Z",
    "dateUpdated": "2026-08-05T09:16:05.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53800",
      "date": "2026-10-02",
      "epss": "0.00139",
      "percentile": "0.02734"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mtd/ubi/vmt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bf9875aa7f7d624a8c084425b14bf7e5907ebc30",
                    "status": "affected",
                    "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf795ebbb9995e2fe7945de71177f01c2f1215dc",
                    "status": "affected",
                    "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9c8be1f165baee53b5a36ea0b3c9281d403a1d0b",
                    "status": "affected",
                    "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "35f8d4064e54c18424db2997059d4c0b1d13d093",
                    "status": "affected",
                    "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "53818746e549e61841428892a8d94344494be797",
                    "status": "affected",
                    "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b0c951742348d216f094d16ed4f70ae73db881c0",
                    "status": "affected",
                    "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3d6378f7056ac7350338f941001162a8f660853c",
                    "status": "affected",
                    "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9af31d6ec1a4be4caab2550096c6bd2ba8fba472",
                    "status": "affected",
                    "version": "801c135ce73d5df1caf3eca35b66a10824ae0707",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mtd/ubi/vmt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.22"
                  },
                  {
                    "lessThan": "2.6.22",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.308",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.276",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.235",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.173",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.100",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: Fix use-after-free when volume resizing failed\n\nThere is an use-after-free problem reported by KASAN:\n  ==================================================================\n  BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi]\n  Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735\n\n  CPU: 2 PID: 4735 Comm: ubirsvol\n  Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n  BIOS 1.14.0-1.fc33 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x34/0x44\n   print_report+0x171/0x472\n   kasan_report+0xad/0x130\n   ubi_eba_copy_table+0x11f/0x1c0 [ubi]\n   ubi_resize_volume+0x4f9/0xbc0 [ubi]\n   ubi_cdev_ioctl+0x701/0x1850 [ubi]\n   __x64_sys_ioctl+0x11d/0x170\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n   \u003c/TASK\u003e\n\nWhen ubi_change_vtbl_record() returns an error in ubi_resize_volume(),\n\"new_eba_tbl\" will be freed on error handing path, but it is holded\nby \"vol-\u003eeba_tbl\" in ubi_eba_replace_table(). It means that the liftcycle\nof \"vol-\u003eeba_tbl\" and \"vol\" are different, so when resizing volume in\nnext time, it causing an use-after-free fault.\n\nFix it by not freeing \"new_eba_tbl\" after it replaced in\nubi_eba_replace_table(), while will be freed in next volume resizing."
          }
        ],
        "id": "CVE-2023-53800",
        "lastModified": "2026-08-04T10:19:21.800",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-09T01:16:51.727",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/35f8d4064e54c18424db2997059d4c0b1d13d093"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3d6378f7056ac7350338f941001162a8f660853c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/53818746e549e61841428892a8d94344494be797"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9af31d6ec1a4be4caab2550096c6bd2ba8fba472"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9c8be1f165baee53b5a36ea0b3c9281d403a1d0b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b0c951742348d216f094d16ed4f70ae73db881c0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf795ebbb9995e2fe7945de71177f01c2f1215dc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf9875aa7f7d624a8c084425b14bf7e5907ebc30"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:16:24+00:00",
      "cve": "CVE-2023-53800",
      "id": "CVE-2023-53800",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ubi: Fix use-after-free when volume resizing failed",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53800.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.