CVE-2026-86096: PX4 Autopilot Use-After-Free Vulnerability

CVE-2026-86096 Overview

CVE-2026-86096 is a use-after-free vulnerability [CWE-416] in PX4 Autopilot versions through 1.17.0. The flaw exists in TemperatureCalibration::start() within the temperature compensation module. A race condition between task spawning and object deletion allows writes to freed heap memory. Attackers with shell access can trigger the calibration process to corrupt unrelated objects or allocator metadata, destabilizing heap operations on the flight controller.

Critical Impact
Heap corruption on an unmanned aerial vehicle autopilot can destabilize flight-critical processes, leading to loss of vehicle control or denial of service on the airframe.

Affected Products

PX4 Autopilot versions up to and including 1.17.0
temperature_compensation module (temperature_calibration/task.cpp)
Deployments exposing PX4 shell (MAVLink/nsh) over adjacent network interfaces

Discovery Timeline

2026-09-04 - CVE-2026-86096 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86096

Vulnerability Analysis

The vulnerability resides in the temperature calibration task startup logic in src/modules/temperature_compensation/temperature_calibration/task.cpp. When an operator invokes the calibration command through the PX4 shell, TemperatureCalibration::start() spawns a worker task and stores a task handle. The parent code path can delete the associated calibration object while the spawned task continues executing. Subsequent writes from the spawned task target memory that has already been returned to the allocator.

Because PX4 runs on real-time operating systems such as NuttX with a shared heap, corrupted allocator metadata affects unrelated flight components. The result is unpredictable behavior across sensor fusion, control loops, and telemetry publishers that share the heap arena.

Root Cause

The root cause is missing synchronization between the caller of start() and the newly spawned calibration task. The task references object state (member fields, uORB publications) after the object owning that state may already be freed. The upstream patch removes the retained _control_task handle and restructures ownership so the spawned task no longer relies on a lifetime-extended parent object.

Attack Vector

Exploitation requires the attacker to reach the PX4 command shell, which is typically available via MAVLink shell passthrough, USB console, or a companion computer on the adjacent network. No authentication is required on default PX4 builds. Issuing a temperature_calibration command triggers the race window.

cpp

// Patch excerpt from src/modules/temperature_compensation/temperature_calibration/task.cpp
 	uORB::Publication<led_control_s> _led_control_pub{ORB_ID(led_control)};
 
 	bool	_force_task_exit = false;
-	int	_control_task = -1;		// task handle for task
 
 	const bool _accel; ///< enable accel calibration?
 	const bool _gyro;  ///< enable gyro calibration?

Source: PX4 Commit b182e523d — the fix removes the retained task handle field that participated in the unsafe lifetime relationship between the parent object and the spawned calibration task.

Detection Methods for CVE-2026-86096

Indicators of Compromise

Unexpected temperature_calibration invocations recorded in the PX4 nsh or MAVLink shell logs during flight or pre-arm phases.
Autopilot reboots, watchdog resets, or HardFault entries in the ULog immediately after calibration commands.
Corrupted uORB topic contents or unexplained failures in unrelated subsystems (LED control, sensor drivers) following a calibration request.

Detection Strategies

Instrument the PX4 build with heap sanitizers or NuttX memory guard hooks to flag writes to freed regions during calibration workflows.
Monitor MAVLink command streams on ground control station networks for MAV_CMD_PREFLIGHT_CALIBRATION and shell passthrough traffic originating from unexpected sources.
Review companion-computer syslogs for scripted calls to the PX4 shell that trigger calibration outside of authorized maintenance windows.

Monitoring Recommendations

Centralize ULog and dmesg output from fleet vehicles into a logging pipeline to correlate calibration commands with subsequent stability events.
Alert on repeated calibration commands within short intervals, which is atypical for legitimate operator behavior.
Track firmware versions across the fleet and flag any airframe still running PX4 Autopilot 1.17.0 or earlier.

How to Mitigate CVE-2026-86096

Immediate Actions Required

Restrict access to the PX4 shell interfaces, including MAVLink shell passthrough and USB consoles, to trusted maintenance workstations.
Segment ground control station and companion-computer networks so unmanned vehicles are not reachable from general-purpose LANs.
Disable or gate the temperature_calibration command in operational builds if calibration is not required during a mission.

Patch Information

Apply the fix merged in PX4 Pull Request #28487 and commit b182e523d. Rebuild firmware from a tree that includes the patch and flash all affected airframes. Refer to the VulnCheck Advisory for PX4 for advisory-level guidance.

Workarounds

Perform temperature calibration only on the ground with the vehicle disarmed and rebooted afterward to reset heap state.
Remove the temperature_calibration command from the shell command table in downstream builds where the capability is not needed.
Enforce MAVLink authentication or a signed command channel between the ground control station and the autopilot to prevent unauthorized shell issuance.

bash

# Verify installed PX4 firmware version before flight
px4-shell> ver all
# Expected: version > 1.17.0 containing commit b182e523d