Expired pointer dereference in Linux kernel - CVE-2026-17523
Published: July 30, 2026
Vulnerability identifier: #VU140104
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-17523
CWE-ID: CWE-825
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code within the kernel and escalate privileges.
The vulnerability exists due to CWE-825 in net/can/bcm.c in can: bcm when processing local CAN BCM operations. A local user can exploit the flaw to execute arbitrary code within the kernel and escalate privileges.
Successful exploitation can allow the attacker to gain root privileges and take full control of the affected system.
Affected software
Linux kernel
How to mitigate CVE-2026-17523
Install security update from vendor's repository.