CVE-2026-85035

The can add rx filter msgq() system call installs a CAN RX filter whose callback (can msgq put() in drivers/can/can common.c) is handed the caller's struct k msgq * as user data. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame arrives. The system call verifier z vrfy can add rx filter msgq() in drivers/can/can handlers.c validated the queue only with K SYSCALL OBJ(), which is a point-in-time check of type, initialization and caller permission and says nothing about the object's lifetime.

On a build with CONFIG USERSPACE=y and CONFIG DYNAMIC OBJECTS=y, an unprivileged user-mode thread that has been granted access to a CAN device can obtain a message queue whose lifetime it fully controls: k object alloc(K OBJ MSGQ) followed by k msgq alloc init(). The lifetime of such an object is driven solely by its permission bitmask, and a pointer retained by the kernel is not represented there. After registering the filter, the thread calls k object release() — or simply terminates — and unref check() frees the struct k msgq storage while the CAN driver still holds the pointer.

The next matching CAN frame causes k msgq put() to run in supervisor context against freed memory that the attacker can have groomed with another kernel allocation: the frame payload is memcpy()d through the reused block's write ptr, and the queue's wait q (and poll events under CONFIG POLL) list nodes are manipulated. This yields kernel-heap corruption reachable from a user-mode thread, defeating the isolation CONFIG USERSPACE is intended to provide; the same dangling pointer also arises benignly when an application thread exits without calling can remove rx filter().

The fix validates the queue with K SYSCALL OBJ STATIC(), which additionally rejects objects carrying K OBJ FLAG ALLOC, so only statically defined queues (CAN MSGQ DEFINE()) may be registered from user mode. Supervisor-mode callers bypass the verifier and must themselves keep the queue valid until the filter is removed.