---
id: CVE-2023-53481
title: "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed\n\nFollowing process will trigger an infinite loop in ubi_wl_put_peb():\n\n\tubifs_bgt\t\tubi_bgt\nubifs_l…"
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed\n\nFollowing process will trigger an infinite loop in ubi_wl_put_peb():\n\n\tubifs_bgt\t\tubi_bgt\nubifs_l…"
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-835
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.25, < 4.14.308'
  - 'linux_kernel >= 4.15, < 4.19.276'
  - 'linux_kernel >= 4.20, < 5.4.235'
  - 'linux_kernel >= 5.5, < 5.10.173'
  - 'linux_kernel >= 5.11, < 5.15.100'
  - 'linux_kernel >= 5.16, < 6.1.18'
  - 'linux_kernel >= 6.2, < 6.2.5'
patched:
  - linux_kernel 6.2.5
published: '2025-10-01'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:40.303'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-53481'
references:
  - url: 'https://git.kernel.org/stable/c/3afaaf6f5867dc4ad383808d4053f428ec7b867d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d57a7333e26040f2b583983e1970d9d460e56b0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5af1c643184a5d09ff5b3f334077a4d0a163c677'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8a18856e074479bd050b01e688c58defadce7ab0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b40d2fbf47af58377e898b5062077a47bb28a132'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b5be23f6ae610bdb262160a1f294afee6d0e6a69'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cc4bc532acda66189bddc03b3fe1ad689d9a48a2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f006f596fe851c3b6aae60b79f89f89f0e515d2f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00164
epssPercentile: 0.05517
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:34:44.820023Z'
ingestedAt: '2026-10-15T22:48:25.403Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed

Following process will trigger an infinite loop in ubi_wl_put_peb():

	ubifs_bgt		ubi_bgt
ubifs_leb_unmap
  ubi_leb_unmap
    ubi_eba_unmap_leb
      ubi_wl_put_peb	wear_leveling_worker
                          e1 = rb_entry(rb_first(&ubi->used)
			  e2 = get_peb_for_wl(ubi)
			  ubi_io_read_vid_hdr  // return err (flash fault)
			  out_error:
			    ubi->move_from = ubi->move_to = NULL
			    wl_entry_destroy(ubi, e1)
			      ubi->lookuptbl[e->pnum] = NULL
      retry:
        e = ubi->lookuptbl[pnum];	// return NULL
	if (e == ubi->move_from) {	// NULL == NULL gets true
	  goto retry;			// infinite loop !!!

$ top
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     COMMAND
  7676 root     20   0       0      0      0 R 100.0  0.0  ubifs_bgt0_0

Fix it by:
 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has
    been removed from 'ubi->lookuptbl'.
 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an
    use-after-free problem for wl entry in ubi_wl_put_peb().

Fetch a reproducer in [Link].

## Affected

- `linux_kernel >= 2.6.25, < 4.14.308`
- `linux_kernel >= 4.15, < 4.19.276`
- `linux_kernel >= 4.20, < 5.4.235`
- `linux_kernel >= 5.5, < 5.10.173`
- `linux_kernel >= 5.11, < 5.15.100`
- `linux_kernel >= 5.16, < 6.1.18`
- `linux_kernel >= 6.2, < 6.2.5`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.2.5`