{"id":"DEBIAN-CVE-2023-53800","details":"In the Linux kernel, the following vulnerability has been resolved:  ubi: Fix use-after-free when volume resizing failed  There is an use-after-free problem reported by KASAN:   ==================================================================   BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi]   Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735    CPU: 2 PID: 4735 Comm: ubirsvol   Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),   BIOS 1.14.0-1.fc33 04/01/2014   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x34/0x44    print_report+0x171/0x472    kasan_report+0xad/0x130    ubi_eba_copy_table+0x11f/0x1c0 [ubi]    ubi_resize_volume+0x4f9/0xbc0 [ubi]    ubi_cdev_ioctl+0x701/0x1850 [ubi]    __x64_sys_ioctl+0x11d/0x170    do_syscall_64+0x35/0x80    entry_SYSCALL_64_after_hwframe+0x46/0xb0    \u003c/TASK\u003e  When ubi_change_vtbl_record() returns an error in ubi_resize_volume(), \"new_eba_tbl\" will be freed on error handing path, but it is holded by \"vol-\u003eeba_tbl\" in ubi_eba_replace_table(). It means that the liftcycle of \"vol-\u003eeba_tbl\" and \"vol\" are different, so when resizing volume in next time, it causing an use-after-free fault.  Fix it by not freeing \"new_eba_tbl\" after it replaced in ubi_eba_replace_table(), while will be freed in next volume resizing.","modified":"2026-09-15T09:02:55.430885464Z","published":"2025-12-09T01:16:51.727Z","upstream":["CVE-2023-53800"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53800"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53800.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53800.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.20-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53800.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}