{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zephyr-rtos--patched-version/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-85035"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zephyr RTOS (\u003c patched version)"],"_cs_severities":["high"],"_cs_tags":["kernel-vulnerability","use-after-free","zephyr"],"_cs_type":"advisory","_cs_vendors":["Zephyr Project"],"content_html":"\u003cp\u003eCVE-2026-85035 is a use-after-free vulnerability in the Zephyr RTOS CAN subsystem. The system call \u003ccode\u003ecan_add_rx_filter_msgq()\u003c/code\u003e fails to validate the lifetime of \u003ccode\u003estruct k_msgq\u003c/code\u003e objects passed as \u003ccode\u003euser_data\u003c/code\u003e for filter callbacks. When \u003ccode\u003eCONFIG_USERSPACE\u003c/code\u003e and \u003ccode\u003eCONFIG_DYNAMIC_OBJECTS\u003c/code\u003e are enabled, an unprivileged thread can register a dynamically allocated message queue, release the object while the kernel retains a pointer to it, and trigger heap corruption when a CAN frame is processed. This enables potential privilege escalation by overwriting kernel structures.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker ensures \u003ccode\u003eCONFIG_USERSPACE\u003c/code\u003e and \u003ccode\u003eCONFIG_DYNAMIC_OBJECTS\u003c/code\u003e are active in the target Zephyr image.\u003c/li\u003e\n\u003cli\u003eAttacker obtains permission to interface with a CAN device.\u003c/li\u003e\n\u003cli\u003eAttacker allocates a message queue using \u003ccode\u003ek_object_alloc(K_OBJ_MSGQ)\u003c/code\u003e and \u003ccode\u003ek_msgq_alloc_init()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker registers the queue via \u003ccode\u003ecan_add_rx_filter_msgq()\u003c/code\u003e, which places a raw pointer to the queue in the kernel filter table.\u003c/li\u003e\n\u003cli\u003eAttacker calls \u003ccode\u003ek_object_release()\u003c/code\u003e or terminates, causing the kernel to free the queue memory while the filter remains active.\u003c/li\u003e\n\u003cli\u003eAttacker grooms the kernel heap to place controlled data in the memory previously occupied by the queue.\u003c/li\u003e\n\u003cli\u003eA CAN frame matching the filter is received, triggering \u003ccode\u003ecan_msgq_put()\u003c/code\u003e in supervisor context against the now-controlled memory, leading to heap corruption.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the official Zephyr Project patch that enforces \u003ccode\u003eK_SYSCALL_OBJ_STATIC()\u003c/code\u003e validation for \u003ccode\u003ecan_add_rx_filter_msgq()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFor firmware developers, ensure that dynamically allocated message queues are not used in conjunction with CAN RX filters in user-mode contexts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T16:01:06Z","date_published":"2026-11-03T16:01:06Z","id":"https://feed.craftedsignal.io/briefs/2026-11-zephyr-can-uaf/","summary":"A use-after-free vulnerability in the Zephyr RTOS CAN subsystem allows unprivileged user-mode threads to trigger kernel heap corruption via dangling pointers in the can_add_rx_filter_msgq() system call.","title":"Zephyr RTOS: Use-after-free in CAN subsystem (CVE-2026-85035)","url":"https://feed.craftedsignal.io/briefs/2026-11-zephyr-can-uaf/"}],"language":"en","title":"CraftedSignal Threat Feed - Zephyr RTOS (\u003c Patched Version)","version":"https://jsonfeed.org/version/1.1"}