Linux CAN BCM use-after-free flaw exposed kernel memory on RHEL 9

Red Hat disclosed and patched CVE-2023-52922, an Important use-after-free flaw in the Linux kernel's CAN Broadcast Manager (CAN BCM) subsystem that could let local, unprivileged users disclose kernel memory on RHEL 9. The bug stemmed from bcm_release() freeing bcm_op objects before removing their procfs entries, allowing bcm_proc_show() to read freed memory concurrently through /proc/net/can-bcm. Red Hat rated the issue CVSS 7.8 and warned it could lead to information disclosure, denial of service, memory corruption, and potentially code execution; fixes were shipped in March 2025 through RHEL 9 kernel advisories including RHSA-2025:2627 and kernel version 5.14.0-503.31.1.el9_5.

Research published by Allele Security showed the flaw could be exploited in environments where unprivileged user and network namespaces are enabled and a CAN interface can be created, such as with VXCAN, to leak encoded SLUB freelist pointers and slab addresses useful for bypassing kernel mitigations. The upstream Linux fix, commit 55c3b96, reordered CAN BCM cleanup so the procfs entry is removed earlier, and the researchers later released proof-of-concept code and noted the subsystem contained additional procfs-related memory-safety issues, including CVE-2025-38003 and CVE-2025-38004; a later upstream patch, commit dac5e62, added missing RCU read protection for CAN BCM procfs handling.