CVE-2026-85035

The canaddrxfiltermsgq system call installs a CAN RX filter whose callback canmsgqput in drivers/can/cancommon.c is handed the caller's struct kmsgq as userdata. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame...

CVE-2026-85035 Use-after-free via dynamically allocated message queue retained by the CAN RX filter

The canaddrxfiltermsgq system call installs a CAN RX filter whose callback canmsgqput in drivers/can/cancommon.c is handed the caller's struct kmsgq as userdata. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame...

CVE-2026-85035

The Zephyr RTOS contains a Use-after-free vulnerability in the can_add_rx_filter_msgq() system call. When CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y are enabled, an unprivileged user-mode thread with CAN device access can register a dynamically allocated message queue. Because the system cal...