Zephyr RTOS: Use-after-free in CAN subsystem (CVE-2026-85035)

CVE-2026-85035 is a use-after-free vulnerability in the Zephyr RTOS CAN subsystem. The system call can_add_rx_filter_msgq() fails to validate the lifetime of struct k_msgq objects passed as user_data for filter callbacks. When CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS are enabled, an unprivileged thread can register a dynamically allocated message queue, release the object while the kernel retains a pointer to it, and trigger heap corruption when a CAN frame is processed. This enables potential privilege escalation by overwriting kernel structures.

Attack Chain

1. Attacker ensures CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS are active in the target Zephyr image.
2. Attacker obtains permission to interface with a CAN device.
3. Attacker allocates a message queue using k_object_alloc(K_OBJ_MSGQ) and k_msgq_alloc_init().
4. Attacker registers the queue via can_add_rx_filter_msgq(), which places a raw pointer to the queue in the kernel filter table.
5. Attacker calls k_object_release() or terminates, causing the kernel to free the queue memory while the filter remains active.
6. Attacker grooms the kernel heap to place controlled data in the memory previously occupied by the queue.
7. A CAN frame matching the filter is received, triggering can_msgq_put() in supervisor context against the now-controlled memory, leading to heap corruption.

Recommendation

• Apply the official Zephyr Project patch that enforces K_SYSCALL_OBJ_STATIC() validation for can_add_rx_filter_msgq().
• For firmware developers, ensure that dynamically allocated message queues are not used in conjunction with CAN RX filters in user-mode contexts.