CVE-2026-17523

HighCVSS 7.8/10Last modified Oct 2, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

This patch switches the timer to HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the hrtimer_tasklet.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 27, 2026
Last modified
Oct 2, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-175247.5Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the CVE-2026-175255.2Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.CVE-2026-175267.2Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role CVE-2026-175277.7In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resourcesCVE-2026-175286.1Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supCVE-2026-175296.3A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agentCVE-2026-17536.8The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to updCVE-2026-175306.3A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolsCVE-2026-175315.0A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/CVE-2026-175326.1The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in veCVE-2026-175337.2The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network adminisCVE-2026-175345.5Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSa
CVE-2026-17523: High severity, CVSS 7.8 | Vulnix