{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","product":"zephyr","source":"CNA: zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"1.14.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"cveId":"CVE-2026-85035","cwes":["CWE-416"],"description":"The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame arrives. The system call verifier z_vrfy_can_add_rx_filter_msgq() in drivers/can/can_handlers.c validated the queue only with K_SYSCALL_OBJ(), which is a point-in-time check of type, initialization and caller permission and says nothing about the object's lifetime.\n\nOn a build with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y, an unprivileged user-mode thread that has been granted access to a CAN device can obtain a message queue whose lifetime it fully controls: k_object_alloc(K_OBJ_MSGQ) followed by k_msgq_alloc_init(). The lifetime of such an object is driven solely by its permission bitmask, and a pointer retained by the kernel is not represented there. After registering the filter, the thread calls k_object_release() — or simply terminates — and unref_check() frees the struct k_msgq storage while the CAN driver still holds the pointer.\n\nThe next matching CAN frame causes k_msgq_put() to run in supervisor context against freed memory that the attacker can have groomed with another kernel allocation: the frame payload is memcpy()d through the reused block's write_ptr, and the queue's wait_q (and poll_events under CONFIG_POLL) list nodes are manipulated. This yields kernel-heap corruption reachable from a user-mode thread, defeating the isolation CONFIG_USERSPACE is intended to provide; the same dangling pointer also arises benignly when an application thread exits without calling can_remove_rx_filter().\n\nThe fix validates the queue with K_SYSCALL_OBJ_STATIC(), which additionally rejects objects carrying K_OBJ_FLAG_ALLOC, so only statically defined queues (CAN_MSGQ_DEFINE()) may be registered from user mode. Supervisor-mode callers bypass the verifier and must themselves keep the queue valid until the filter is removed.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: zephyr","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793712968995,"publishedAt":1793712968995,"references":[{"source":"CNA: zephyr","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/0114bee266211c72a49f3b6a914d3eaf821dd460"},{"source":"CNA: zephyr","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6pxv-r7ww-3g2q"}],"remediation":[{"kind":"fix","source":"CNA: zephyr","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zephyrproject-rtos/zephyr/commit/0114bee266211c72a49f3b6a914d3eaf821dd460"}],"revision":"b127a7f054a2bf996d85f2a87635e67cf2cc01635c4384b75a44af5318694856","sources":[{"modifiedAt":1793712968995,"name":"CNA: zephyr","retrievedAt":1793715011125,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85035"}],"ssvc":null,"status":"published","title":"Use-after-free via dynamically allocated message queue retained by the CAN RX filter","updatedAt":1793715011125}