Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2023-53265— ubi: ensure that VID header offset + VID header size <= alloc, size

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于VID头偏移和大小未正确验证，可能导致越界读取。

AI Predicted 6.5 Difficulty: Easy EPSS 0.16% · P5 Updated May 13, 2026

Possible ATT&CK Techniques 2 AI

T1612 · Build Image on Host T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

Vendor	Product	Version Range	Status
Linux	Linux	`801c135ce73d5df1caf3eca35b66a10824ae0707< 61e04db3bec87f7dd10074296deb7d083e2ccade`	affected
		`801c135ce73d5df1caf3eca35b66a10824ae0707< 771e207a839a29ba943e89f473b0fecd16089e2e`	affected
		`801c135ce73d5df1caf3eca35b66a10824ae0707< f7adb740f97b6fa84e658892dcb08e37a31a4e77`	affected
		`801c135ce73d5df1caf3eca35b66a10824ae0707< 846bfba34175c23b13cc2023c2d67b96e8c14c43`	affected
		`801c135ce73d5df1caf3eca35b66a10824ae0707< 701bb3ed5a88a73ebbe1266895bdeff065226dca`	affected
		`801c135ce73d5df1caf3eca35b66a10824ae0707< 61aeba0e4b4124cfe3c5427feaf29c626dfa89e5`	affected
		`801c135ce73d5df1caf3eca35b66a10824ae0707< e1b73fe4f4c6bb80755eb4bf4b867a8fd8b1a7fe`	affected
		`801c135ce73d5df1caf3eca35b66a10824ae0707< 1b42b1a36fc946f0d7088425b90d491b4257ca3e`	affected
… +10 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-53265

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ubi: ensure that VID header offset + VID header size <= alloc, size

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: ubi: ensure that VID header offset + VID header size <= alloc, size Ensure that the VID header offset + VID header size does not exceed the allocated area to avoid slab OOB. BUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197 Read of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555 CPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G W 6.0.0-1868 #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x85/0xad lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433 kasan_report+0xa7/0x11b mm/kasan/report.c:495 crc32_body lib/crc32.c:111 [inline] crc32_le_generic lib/crc32.c:179 [inline] crc32_le_base+0x58c/0x626 lib/crc32.c:197 ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067 create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 RIP: 0033:0x7f96d5cf753d Code: RSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d RDX: 0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003 RBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0 R13: 00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 1555: kasan_save_stack+0x20/0x3d mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525 kasan_kmalloc include/linux/kasan.h:234 [inline] __kmalloc+0x138/0x257 mm/slub.c:4429 kmalloc include/linux/slab.h:605 [inline] ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline] create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 The buggy address belongs to the object at ffff88802bb36e00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff88802bb36e00, ffff88802bb36f00) The buggy address belongs to the physical page: page:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bb36 head:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40 raw: 0000000000000000 00000000001 ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于VID头偏移和大小未正确验证，可能导致越界读取。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	801c135ce73d5df1caf3eca35b66a10824ae0707 ~ 61e04db3bec87f7dd10074296deb7d083e2ccade	-
Linux	Linux	2.6.22	-

II. Public POCs for CVE-2023-53265

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2023-53265

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2023-53265

Same Patch Batch · Linux · 2025-09-16 · 115 CVEs total

CVE-2022-50350	9.8 CRITICAL	scsi: target: iscsi: Fix a race condition between login_work and the login thread
CVE-2025-39806	8.8 HIGH	HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
CVE-2023-53315	8.8 HIGH	wifi: ath11k: Fix SKB corruption in REO destination ring
CVE-2023-53305	8.8 HIGH	Bluetooth: L2CAP: Fix use-after-free
CVE-2025-39827	8.8 HIGH	net: rose: include node references in rose_neigh refcount
CVE-2025-39826	8.8 HIGH	net: rose: convert 'use' field to refcount_t
CVE-2023-53322	8.8 HIGH	scsi: qla2xxx: Wait for io return on terminate rport
CVE-2023-53297	8.8 HIGH	Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
CVE-2025-39809	8.4 HIGH	HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
CVE-2023-53333	8.2 HIGH	netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
CVE-2023-53314	7.8 HIGH	fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
CVE-2025-39818	7.8 HIGH	HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
CVE-2025-39815	7.8 HIGH	RISC-V: KVM: fix stack overrun when loading vlenb
CVE-2023-53286	7.8 HIGH	RDMA/mlx5: Return the firmware result upon destroying QP/RQ
CVE-2023-53311	7.8 HIGH	nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
CVE-2022-50341	7.8 HIGH	cifs: fix oops during encryption
CVE-2025-39825	7.8 HIGH	smb: client: fix race with concurrent opens in rename(2)
CVE-2023-53274	7.8 HIGH	clk: mediatek: mt8183: Add back SSPM related clocks
CVE-2025-39810	7.8 HIGH	bnxt_en: Fix memory corruption when FW resources change during ifdown
CVE-2023-53331	7.8 HIGH	pstore/ram: Check start of empty przs during init

Showing top 20 of 115 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2023-53265

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-53265— ubi: ensure that VID header offset + VID header size <= alloc, size

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 18

I. Basic Information for CVE-2023-53265

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2023-53265

III. Intelligence Information for CVE-2023-53265

Same Patch Batch · Linux · 2025-09-16 · 115 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2023-53265

Leave a comment