CVE-2026-23362: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23362 is a missing spin lock initialization vulnerability in the Linux kernel's CAN BCM (Broadcast Manager) module that can allow a local attacker to trigger a kernel denial of service. The flaw was introduced when commit c2aba69d0c36 added locking for bcm_op runtime updates in bcm_tx_setup(), but failed to initialize the corresponding bcm_tx_lock in bcm_rx_setup() for the RTR (Remote Transmission Request) frame path. It affects multiple Linux kernel stable branches across versions 5.4.294 through 7.0-rc7. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-909 (Missing Initialization of Resource) and CWE-667 (Improper Locking). When bcm_rx_setup() allocates a new bcm_op structure to handle incoming CAN traffic with the RX_RTR_FRAME flag set, it omits the spin_lock_init() call for bcm_tx_lock. When a matching RTR frame is subsequently received, bcm_can_tx() is invoked and attempts to acquire this uninitialized spinlock, leading to undefined kernel behavior. Exploitation requires local access and low privileges — an attacker must be able to open a CAN BCM socket and issue RX_SETUP commands with the RX_RTR_FRAME flag, then trigger RTR frame reception to race the uninitialized lock (Red Hat CVE, Feedly).

Successful exploitation allows an unprivileged local user to cause kernel memory corruption and a potential system crash (kernel panic), resulting in a denial of service with high availability impact. There is no direct confidentiality or integrity impact to user data, though kernel data structure integrity is compromised during exploitation. Systems with active CAN bus interfaces and untrusted local users are at greatest risk (Feedly).

Patches have been released across all affected stable kernel branches. Administrators should update to the following fixed versions or later: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.77+, 6.18.17+, and 6.19.7+; the fix is also included in 7.0-rc3 and later release candidates. Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-2026:1668-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Debian (DSA-6243-1, DLA-4561-1), and Amazon Linux 2023. If immediate patching is not possible, restrict local user access and disable CAN BCM functionality (modprobe -r can_bcm) if not operationally required (Red Hat CVE, SUSE Advisory, Feedly).