# CVE-2026-85035: Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()

Source: https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-85035 · Severity: high · CVSS 8.8 · Published 2026-11-03

Zephyr's CAN driver allows unprivileged user-mode applications to register message queue filters on CAN devices. An attacker can free the message queue after registration but before the filter is removed, causing the kernel to dereference a dangling pointer when processing incoming CAN frames. This leads to kernel heap corruption and violates the security isolation that CONFIG_USERSPACE is intended to provide.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-85035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85035 being exploited in the wild.

**How severe is CVE-2026-85035?** High severity, with a CVSS score of 8.8, published 3 November 2026.

**Which products and versions are affected?** Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y prior to the fix.

**Is there a fix for CVE-2026-85035?** Yes: fixed in Fixed by validating the message queue with K_SYSCALL_OBJ_STATIC() instead of K_SYSCALL_OBJ(). Until then: Disable CONFIG_DYNAMIC_OBJECTS or CONFIG_USERSPACE if CAN device access is not required for unprivileged user-mode applications. Restrict CAN device access to privileged kernel threads only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85035 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-85035?** Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fixed by validating the message queue with K_SYSCALL_OBJ_STATIC() instead of K_SYSCALL_OBJ()

Disable CONFIG_DYNAMIC_OBJECTS or CONFIG_USERSPACE if CAN device access is not required for unprivileged user-mode applications. Restrict CAN device access to privileged kernel threads only.

## Technical details

The can_add_rx_filter_msgq() system call validates the user-supplied message queue pointer with K_SYSCALL_OBJ(), a point-in-time check that does not enforce object lifetime guarantees. On kernels with CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled, an unprivileged thread can allocate a message queue with k_object_alloc() and k_msgq_alloc_init(), register it as a CAN filter, then release or free the object while the CAN driver retains a raw pointer. Subsequent matching CAN frames trigger use-after-free in can_msgq_put(), allowing heap corruption through memcpy() into attacker-controlled memory and list manipulation via the queue's wait_q and poll_events fields.

## Affected products

- Zephyr Project Zephyr RTOS versions with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y prior to the fix

## Timeline

- 2026-11-03: disclosed

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)
- [Zephyr device multiplexer privilege escalation in devmux](https://junglewise.ai/threats/cve-2026-19947-the-device-multiplexer-pseudo-driver-in-drivers-misc-devmux)