A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1750:72 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
      * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61932 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55764 advisory.

    - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991}
    - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009}
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327]     {CVE-2026-43206}
    - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI     Backport Bot) [RHEL-222576] {CVE-2026-64219}
    - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879}
    - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884}
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662]     {CVE-2026-53329}
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680]     {CVE-2026-53136}
    - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino)     [RHEL-226551] {CVE-2025-39902}
    - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374}
    - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}
    - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}
    - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
    - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
    - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}
    - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}
    - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
    - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55764 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to RHEL 8.10 (JIRA:RHEL-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:RHEL-224556)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55764 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
      * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)


    Bug Fix(es) and Enhancement(s):

      * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to AlmaLinux 8.10     (JIRA:AlmaLinux-189997)
      * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z]     (JIRA:AlmaLinux-224556)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55765 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
      * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)


    Bug Fix(es) and Enhancement(s):

      * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to AlmaLinux 8.10     (JIRA:AlmaLinux-189997)
      * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z]     (JIRA:AlmaLinux-224556)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55764 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to Rocky Linux 8.10 (JIRA:Rocky     Linux-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55765 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to Rocky Linux 8.10 (JIRA:Rocky     Linux-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55765 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to RHEL 8.10 (JIRA:RHEL-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:RHEL-224556)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can     exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege     escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected     system. (CVE-2026-17523)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
342592	MiracleLinux 8 : kernel-4.18.0-553.156.1.el8_10 (AXSA:2026-1750:72)	Nessus	Miracle Linux Local Security Checks	Local	high
342148	RHEL 8 : kernel (RHSA-2026:61932)	Nessus	Red Hat Local Security Checks	Local	critical
338777	Oracle Linux 8 : kernel (ELSA-2026-55764)	Nessus	Oracle Linux Local Security Checks	Local	high
337336	RHEL 8 : kernel (RHSA-2026:55764)	Nessus	Red Hat Local Security Checks	Local	high
337148	AlmaLinux 8 : kernel (ALSA-2026:55764)	Nessus	Alma Linux Local Security Checks	Local	high
337146	AlmaLinux 8 : kernel-rt (ALSA-2026:55765)	Nessus	Alma Linux Local Security Checks	Local	high
337100	RockyLinux 8 : kernel (RLSA-2026:55764)	Nessus	Rocky Linux Local Security Checks	Local	high
337095	RockyLinux 8 : kernel-rt (RLSA-2026:55765)	Nessus	Rocky Linux Local Security Checks	Local	high
335994	RHEL 8 : kernel-rt (RHSA-2026:55765)	Nessus	Red Hat Local Security Checks	Local	high
330170	Linux Distros Unpatched Vulnerability : CVE-2026-17523	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-17523

high

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high