CVE-2026-85035 Use-after-free via dynamically allocated message queue retained by the CAN RX filter

The canaddrxfiltermsgq system call installs a CAN RX filter whose callback canmsgqput in drivers/can/cancommon.c is handed the caller's struct kmsgq as userdata. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame...