CVE-2026-85035

The canaddrxfiltermsgq system call installs a CAN RX filter whose callback canmsgqput in drivers/can/cancommon.c is handed the caller's struct kmsgq as userdata. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame...