Description
create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.
Affected products
linux: linux kernel
References10
- git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/…
- groups.google.com/g/syzkaller/c/Xl97YcQA4hg Third Party Advisory
- lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/co…
- www.spinics.net/lists/kernel/msg5074816.html Mailing List
- git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/…
- groups.google.com/g/syzkaller/c/Xl97YcQA4hg Third Party Advisory
- lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Metrics
- CVSS 3.1
-
5.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 0% percentile: 16 · as of 5 November 2026
- CWE
- CWE-754
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.