PT-2025-40188 · Linux+1 · Linux Kernel+1

Published 2025-10-01 · Updated 2025-10-31 · CVE-2023-53481

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel related to wear-leveling within the UBI (Unsorted Block Image) subsystem. A flaw in the ubi wl put peb() function can lead to an infinite loop under specific conditions during wear-leveling operations. This occurs when a wear-leveling entry is removed from ubi->lookuptbl but the function does not handle this scenario correctly, resulting in a continuous retry loop. The process flow involves ubifs bgt, ubi bgt, ubifs leb unmap, ubi leb unmap, ubi eba unmap leb, ubi wl put peb, and wear leveling worker. The issue is triggered when ubi wl put peb() attempts to access a removed entry in ubi->lookuptbl, leading to the infinite loop. The ubifs bgt0 0 process can consume 100% CPU during this loop.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2026-06022

CVE-2023-53481

OESA-2025-2553

Affected Products

Astra Linux

Linux Kernel

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53481.json · Exploit
• https://bdu.fstec.ru/vul/2026-06022 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53453 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50494 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53567 · Security Note
• https://git.kernel.org/stable/c/b40d2fbf47af58377e898b5062077a47bb28a132 · Patch
• https://git.kernel.org/stable/c/4d57a7333e26040f2b583983e1970d9d460e56b0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-53168 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53265 · Security Note
• https://ubuntu.com/security/CVE-2023-53481 · Vendor Advisory
• https://git.kernel.org/stable/c/f006f596fe851c3b6aae60b79f89f89f0e515d2f · Patch
• https://git.kernel.org/stable/c/cc4bc532acda66189bddc03b3fe1ad689d9a48a2 · Patch
• https://git.kernel.org/stable/c/8a18856e074479bd050b01e688c58defadce7ab0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53372 · Security Note
• https://git.kernel.org/stable/c/b5be23f6ae610bdb262160a1f294afee6d0e6a69 · Patch