CVE-2026-85035 - Use-after-free via dynamically allocated message queue retained by the CAN RX filter
CVE ID :CVE-2026-85035 Published : Nov. 3, 2026, 2:17 p.m. | 46 minutes ago Description :The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver...