Date: 2026-08-19
NOTE: RHEL 9, 10 and their derivatives are NOT affected.
An important flaw in the Linux kernel’s CAN BCM module allows an unprivileged local user to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). [R 1]
EGI SVG ID : EGI-SVG-2026-40
CVE ID : CVE-2026-17523
CVSSv3 Score:
Sites are advised to update as soon as possible the Linux kernel on hosts giving access to unprivileged users, e.g. grid worker nodes, but also container hosts, notebook servers and CI runners.
At the time of writing, fixed kernels are available for most of the relevant distributions. Please check the references listed at the bottom of this advisory for your distribution(s), update and reboot affected systems as soon as feasible.
On concerned hosts that do not need it, the “can_bcm” (sic) module can be disabled as follows (mind its correct name):
modprobe -r can_bcm || echo A reboot is needed for the mitigation to work
cat >/etc/modprobe.d/mitigation-cve-2026-17523.conf <<'EOF'
install can_bcm /bin/false
blacklist can_bcm
EOF
TLP:CLEAR information - Unlimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2026-40
https://advisories.egi.eu/Advisory-SVG-CVE-2026-17523
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. -----------------------------
Comments or questions should be sent to svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu
See [R 99] for further details, and other information on SVG.
SVG was alerted to this vulnerability by Laurent Caillat-Vallet (EGI CSIRT)