Zephyr RTOS (< Patched Version) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/zephyr-rtos--patched-version/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 16:01:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgZephyr RTOS: Use-after-free in CAN subsystem (CVE-2026-85035)https://feed.craftedsignal.io/briefs/2026-11-zephyr-can-uaf/Tue, 03 Nov 2026 16:01:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-zephyr-can-uaf/A use-after-free vulnerability in the Zephyr RTOS CAN subsystem allows unprivileged user-mode threads to trigger kernel heap corruption via dangling pointers in the can_add_rx_filter_msgq() system call.CVE-2026-85035 is a use-after-free vulnerability in the Zephyr RTOS CAN subsystem. The system call can_add_rx_filter_msgq() fails to validate the lifetime of struct k_msgq objects passed as user_data for filter callbacks. When CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS are enabled, an unprivileged thread can register a dynamically allocated message queue, release the object while the kernel retains a pointer to it, and trigger heap corruption when a CAN frame is processed. This enables potential privilege escalation by overwriting kernel structures.

Attack Chain

  1. Attacker ensures CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS are active in the target Zephyr image.
  2. Attacker obtains permission to interface with a CAN device.
  3. Attacker allocates a message queue using k_object_alloc(K_OBJ_MSGQ) and k_msgq_alloc_init().
  4. Attacker registers the queue via can_add_rx_filter_msgq(), which places a raw pointer to the queue in the kernel filter table.
  5. Attacker calls k_object_release() or terminates, causing the kernel to free the queue memory while the filter remains active.
  6. Attacker grooms the kernel heap to place controlled data in the memory previously occupied by the queue.
  7. A CAN frame matching the filter is received, triggering can_msgq_put() in supervisor context against the now-controlled memory, leading to heap corruption.

Recommendation

  • Apply the official Zephyr Project patch that enforces K_SYSCALL_OBJ_STATIC() validation for can_add_rx_filter_msgq().
  • For firmware developers, ensure that dynamically allocated message queues are not used in conjunction with CAN RX filters in user-mode contexts.
]]>highadvisorykernel-vulnerabilityuse-after-freezephyr