CVE-2026-17523: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-17523 is a local privilege escalation (LPE) vulnerability in the Linux kernel's CAN BCM (Broadcast Manager) subsystem. An unprivileged local user can exploit this flaw to execute arbitrary code within the kernel context, ultimately gaining root privileges and full control of the affected system. The vulnerability affects Red Hat Enterprise Linux (RHEL) kernel and kernel-rt packages, with some RHEL versions listed as affected and others as unaffected per NVD data. It was published on July 27, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-825 (Expired Pointer Dereference), arising from a race condition in the can/bcm kernel module (net/can/bcm.c). The root cause involves the use of hrtimer with tasklets (hrtimer_tasklet) in the CAN BCM implementation, where a timer callback could reference a bcm_op structure after it has been freed or invalidated, leading to an expired pointer dereference and arbitrary kernel code execution. The fix, committed to the Linux kernel mainline, switches the timer to HRTIMER_MODE_SOFT (softirq context) and removes the hrtimer_tasklet pattern entirely, eliminating the race condition. According to the Red Hat Bugzilla report, a working Proof of Concept (PoC) was developed internally, and exploitation in the PoC leverages unprivileged user namespaces and the kernel-modules-extra package, though the vulnerability is reachable without these prerequisites. A companion KASLR bypass (CVE-2025-38004) was used in the PoC to enable reliable exploitation (Red Hat Bugzilla, Linux Commit).

Successful exploitation allows an unprivileged local user to execute arbitrary code in kernel context, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker achieving root privileges can read or exfiltrate any data on the system, modify or destroy system files, install persistent backdoors, disable security controls, and potentially pivot to other systems on the network. The flaw has been present since initial releases of RHEL 8, meaning a broad range of deployed systems may be affected (Red Hat Bugzilla, Github Advisory).

1. Gain local access: Obtain a low-privileged shell on a target system running an affected RHEL kernel with the kernel-modules-extra package installed (or access to unprivileged user namespaces).
2. KASLR bypass (optional but used in PoC): Exploit CVE-2025-38004 or another information leak to defeat Kernel Address Space Layout Randomization (KASLR), obtaining the base address of the kernel to enable reliable exploitation.
3. Trigger the CAN BCM race condition: Interact with the CAN BCM socket interface (AF_CAN, CAN_BCM) to create and manipulate bcm_op structures, triggering the expired pointer dereference in the hrtimer/tasklet handling code in net/can/bcm.c.
4. Achieve kernel code execution: Exploit the use-after-free/expired pointer dereference to redirect kernel execution flow to attacker-controlled code, executing a privilege escalation payload.
5. Escalate to root: The kernel payload modifies the current process's credentials to grant root privileges, providing full control of the system (Red Hat Bugzilla, Linux Commit).

• Logs: Unexpected kernel oops, BUG, or use-after-free messages in /var/log/kern.log or dmesg output related to net/can/bcm.c or hrtimer/tasklet functions.
• Process: Processes that unexpectedly transition to running as UID 0 (root) without a legitimate sudo or su invocation; unusual child processes spawned with root privileges from non-root parent processes.
• Network/Socket: Unexpected creation of AF_CAN/CAN_BCM sockets by non-privileged users on systems where CAN bus usage is not expected.
• File System: New SUID binaries, unexpected modifications to /etc/passwd or /etc/sudoers, or new cron jobs/systemd services created by previously unprivileged accounts.
• Kernel: Kernel crash dumps (/var/crash) or kdump artifacts referencing bcm_op, bcm_tx_timeout_handler, bcm_rx_timeout_handler, or related CAN BCM symbols.

Apply the upstream Linux kernel patch that switches the CAN BCM timer to HRTIMER_MODE_SOFT and removes the hrtimer_tasklet pattern (commit bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68). Red Hat has issued a patch; users should update to the fixed kernel version provided via Red Hat's security advisories for their specific RHEL version. As a workaround, restrict or disable unprivileged user namespaces (sysctl -w kernel.unprivileged_userns_clone=0 where supported) and remove or restrict access to the kernel-modules-extra package to reduce the attack surface, though note the vulnerability is reachable without these prerequisites. Monitor systems for suspicious kernel-level activity and restrict local user access where possible (Red Hat Bugzilla, Linux Commit).

The vulnerability was reported by OSIDB (Red Hat's Open Security Issue Database) and disclosed via Red Hat Bugzilla on July 27, 2026. A Mastodon post by user @hugovalters was observed referencing the CVE shortly after disclosure, indicating early community awareness. No major media coverage or significant public researcher commentary beyond the initial disclosure has been identified at this time (Red Hat Bugzilla).