Is CVE-2026-85035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85035 being exploited in the wild.

How severe is CVE-2026-85035?

High severity, with a CVSS score of 8.8, published 3 November 2026.

Which products and versions are affected?

Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y prior to the fix.

How is CVE-2026-85035 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-85035?

Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()

CVE-2026-85035 · Severity: high · CVSS 8.8 · Published 2026-11-03

Zephyr's CAN driver allows unprivileged user-mode applications to register message queue filters on CAN devices. An attacker can free the message queue after registration but before the filter is removed, causing the kernel to dereference a dangling pointer when processing incoming CAN frames. This leads to kernel heap corruption and violates the security isolation that CONFIG_USERSPACE is intended to provide.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-85035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85035 being exploited in the wild.
How severe is CVE-2026-85035?: High severity, with a CVSS score of 8.8, published 3 November 2026.
Which products and versions are affected?: Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y prior to the fix.
Is there a fix for CVE-2026-85035?: Yes: fixed in Fixed by validating the message queue with K_SYSCALL_OBJ_STATIC() instead of K_SYSCALL_OBJ(). Until then: Disable CONFIG_DYNAMIC_OBJECTS or CONFIG_USERSPACE if CAN device access is not required for unprivileged user-mode applications. Restrict CAN device access to privileged kernel threads only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85035 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-85035?: Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fixed by validating the message queue with K_SYSCALL_OBJ_STATIC() instead of K_SYSCALL_OBJ()

Disable CONFIG_DYNAMIC_OBJECTS or CONFIG_USERSPACE if CAN device access is not required for unprivileged user-mode applications. Restrict CAN device access to privileged kernel threads only.

Technical details

The can_add_rx_filter_msgq() system call validates the user-supplied message queue pointer with K_SYSCALL_OBJ(), a point-in-time check that does not enforce object lifetime guarantees. On kernels with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled, an unprivileged thread can allocate a message queue with k_object_alloc() and k_msgq_alloc_init(), register it as a CAN filter, then release or free the object while the CAN driver retains a raw pointer. Subsequent matching CAN frames trigger use-after-free in can_msgq_put(), allowing heap corruption through memcpy() into attacker-controlled memory and list manipulation via the queue's wait_q and poll_events fields.

Affected products

Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y prior to the fix

Timeline

2026-11-03: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.