CVE-2023-54087 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
ubi: Fix possible null-ptr-deref in ubi_free_volume()
It willl cause null-ptr-deref in the following case:
uif_init() ubi_add_volume() cdev_add() -> if it fails, call kill_volumes() device_register()
kill_volumes() -> if ubi_add_volume() fails call this function ubi_free_volume() cdev_del() device_unregister() -> trying to delete a not added device, it causes null-ptr-deref
So in ubi_free_volume(), it delete devices whether they are added or not, it will causes null-ptr-deref.
Handle the error case whlie calling ubi_add_volume() to fix this problem. If add volume fails, set the corresponding vol to null, so it can not be accessed in kill_volumes() and release the resource in ubi_add_volume() error path.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 01/02/2026
The vulnerability identified as CVE-2023-54087 represents a critical null pointer dereference flaw within the Universal Block Interface (UBI) subsystem of the Linux kernel. This issue manifests in the ubi_free_volume() function where improper error handling leads to system instability and potential denial of service conditions. The vulnerability stems from inadequate state management during volume allocation operations, creating a scenario where device cleanup functions attempt to operate on improperly initialized or failed volume objects.
The technical flaw occurs within the UBI volume management workflow where the uif_init() function initiates volume creation through ubi_add_volume(). During this process, cdev_add() may fail due to resource constraints or system limitations, triggering the error handling path through kill_volumes() function. The problematic sequence begins when ubi_add_volume() fails and calls kill_volumes(), which subsequently invokes ubi_free_volume(). The function attempts to clean up device resources regardless of whether the device was successfully registered, leading to null pointer dereference when trying to delete a device that was never properly added to the system.
This vulnerability directly maps to CWE-476 which identifies null pointer dereference as a common programming error that can result in system crashes or security exploits. The operational impact of this flaw extends beyond simple system instability as it can be leveraged by malicious actors to cause denial of service conditions or potentially escalate privileges through careful exploitation of the kernel's error handling mechanisms. The vulnerability affects systems utilizing UBI volumes for storage management, particularly those employing dynamic volume allocation scenarios where resource contention or allocation failures are possible.
The recommended mitigation strategy involves implementing proper error state management within the ubi_add_volume() function to ensure that volume objects are properly initialized or marked as invalid when allocation fails. This approach aligns with the ATT&CK framework's defense evasion techniques by preventing improper resource cleanup that could be exploited. The fix requires setting volume pointers to null when ubi_add_volume() encounters errors, preventing access to invalid objects during kill_volumes() execution and ensuring proper resource release in error paths. System administrators should prioritize applying kernel updates that contain this specific fix, particularly in environments where UBI volumes are actively utilized for storage operations, as the vulnerability can be triggered through normal volume allocation workflows.