Expired pointer dereference in Linux kernel - CVE-2026-17523

Vulnerability identifier: #VU140104

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-17523

CWE-ID: CWE-825

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code within the kernel and escalate privileges.

The vulnerability exists due to CWE-825 in net/can/bcm.c in can: bcm when processing local CAN BCM operations. A local user can exploit the flaw to execute arbitrary code within the kernel and escalate privileges.

Successful exploitation can allow the attacker to gain root privileges and take full control of the affected system.

Linux kernel
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Server - AUS
kernel (Red Hat package)
kernel-rt-debug (Red Hat package)
kernel-rt-debug-devel (Red Hat package)
kernel-rt-debug-modules-extra (Red Hat package)
kernel-rt-kvm (Red Hat package)

Install security update from vendor's repository.

kernel (Red Hat package) - addressed in versions 4.18.0-305.206.1.el8_4, 4.18.0-372.213.1.el8_6, 4.18.0-553.156.1.el8_10
kernel-rt-debug (Red Hat package) - update to 4.18.0-553.156.1.rt7.497.el8_10
kernel-rt-debug-devel (Red Hat package) - update to 4.18.0-553.156.1.rt7.497.el8_10
kernel-rt-debug-modules-extra (Red Hat package) - update to 4.18.0-553.156.1.rt7.497.el8_10
kernel-rt-kvm (Red Hat package) - update to 4.18.0-553.156.1.rt7.497.el8_10

• https://access.redhat.com/security/cve/CVE-2026-17523
• https://bugzilla.redhat.com/show_bug.cgi?id=2507407
• https://github.com/torvalds/linux/commit/bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68

• Expired pointer dereference in Linux kernel net/can/bcm.c in can: bcm
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 8 update for kernel-rt
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 8 update for kernel