OSG-SEC-2026-08-17 Important-Linux Kernel CAN BCM LPE Vulnerability

Dear OSG Security Contacts,

An Important local privilege escalation vulnerability (LPE), CVE-2026-17523, has been identified in the Linux kernel CAN Broadcast Manager (CAN BCM) implementation [1].

WHAT ARE THE VULNERABILITIES:

CVE-2026-17523 is a vulnerability in the Linux kernel's CAN BCM module that may allow an unprivileged local user to execute arbitrary code in the kernel and gain root privileges. Red Hat reports that a proof of concept has demonstrated local privilege escalation on RHEL 8, including on systems without unprivileged user namespaces or the kernel-modules-extra package.

IMPACTED VERSIONS:

RHEL 8 is affected. The RHEL 8 kernel package has been fixed through RHSA-2026:55764 [2].

RHEL 9 and RHEL 10 are listed as not affected.

MITIGATION

Prevent the can_bcm kernel module from loading if it is not required [3] [4].

sudo modprobe -r can_bcm

echo "blacklist can_bcm" | sudo tee /etc/modprobe.d/blacklist-can-bcm.conf

echo "install can_bcm /bin/false" >> /etc/modprobe.d/local-dontload.conf

A system reboot is required for this change to take effect.

WHAT YOU SHOULD DO:

OSG sites running RHEL 8 should apply the available security update. Sites unable to update immediately should apply Red Hat's recommended mitigation if CAN BCM functionality is not required.

REFERENCES

[1] https://access.redhat.com/security/cve/cve-2026-17523
[2] https://access.redhat.com/errata/RHSA-2026:55764
[3] https://access.redhat.com/solutions/41278.
[4] https://www.sentinelone.com/vulnerability-database/cve-2026-17523/