Heap Corruption Vulnerability in CAN Driver for Zephyr RTOS

CVE-2026-85035

What is CVE-2026-85035?

A vulnerability exists in the CAN driver of Zephyr RTOS that allows an unprivileged user-mode thread to exploit the can_add_rx_filter_msgq() system call. This flaw arises from improper validation of message queue lifetimes, enabling the thread to create and manage a message queue object that can be freed while still referenced by the kernel. When a subsequent CAN frame is processed, the freed memory can be manipulated, ultimately leading to kernel-heap corruption. The fix involved amending the validation process to ensure only statically defined queues can be registered, enhancing the security of user-mode interactions with the CAN device.

References