CVE-2026-86713: PX4 Autopilot Use-After-Free Vulnerability

CVE-2026-86713 Overview

CVE-2026-86713 is a use-after-free vulnerability [CWE-416] in the PX4 Autopilot flight control software through version 1.17.0. The flaw resides in the load_mon module's stop path, where exit_and_cleanup() destroys the LoadMon object and frees the performance counter before perf_end() is invoked on it. An attacker with access to a PX4 shell (PXH) or MAVLink shell can trigger the condition by issuing the load_mon stop command. The resulting reads and writes through freed memory corrupt heap objects and destabilize the flight stack on an operating vehicle.

Critical Impact
Exploitation from an adjacent network position corrupts flight-stack heap memory and can crash the autopilot mid-flight, threatening vehicle availability and safety.

Affected Products

PX4 Autopilot versions up to and including 1.17.0
load_mon module in src/modules/load_mon/LoadMon.cpp
Any airframe or platform (Linux, NuttX) running the affected PX4 build

Discovery Timeline

2026-09-08 - CVE-2026-86713 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86713

Vulnerability Analysis

The LoadMon module in PX4 periodically measures CPU and stack load using a performance counter (_cycle_perf). When the module receives a stop request, the Run() function checks should_exit() and calls exit_and_cleanup(desc). That routine destructs the LoadMon instance, which in turn frees the performance counter allocated in the constructor. Control then falls through to perf_end(_cycle_perf), which dereferences the freed counter object. The result is a classic use-after-free that reads and writes memory the allocator may have already reissued.

Root Cause

The root cause is control-flow ordering in LoadMon::Run(). The perf_end() call was placed after exit_and_cleanup() and lacked an early return following cleanup. Because exit_and_cleanup() deletes this, any subsequent access, including reading _cycle_perf, operates on a dangling pointer. No lifetime guard or ownership check protected the counter before it was accessed.

Attack Vector

Exploitation requires the ability to issue commands to the PX4 shell. This is reachable locally through the PXH console or remotely over a MAVLink shell session available on the adjacent network. An attacker with no privileges beyond shell access issues load_mon stop, which triggers the freed-memory access on the next scheduler tick. Repeated invocation can groom the heap to corrupt adjacent allocations and destabilize flight-critical tasks.

cpp

// Security patch in src/modules/load_mon/LoadMon.cpp
// fix(load_mon): add return code at module stop path (#28544)

 #endif

+	perf_end(_cycle_perf);
+
 	if (should_exit()) {
 		ScheduleClear();
 #if defined (__PX4_LINUX)
 		fclose(_proc_fd);
 #endif
 		exit_and_cleanup(desc);
+		return;
 	}
-
-	perf_end(_cycle_perf);
 }

 void LoadMon::cpuload()

Source: PX4 Autopilot Commit 354823. The patch moves perf_end(_cycle_perf) before the shutdown branch and adds an explicit return after exit_and_cleanup(desc), ensuring no code touches the freed object.

Detection Methods for CVE-2026-86713

Indicators of Compromise

Unexpected load_mon stop commands recorded in PXH console history or MAVLink shell session logs.
Autopilot watchdog resets, task crashes, or nsh panics coinciding with load_mon shutdown events.
Heap corruption diagnostics or HardFault entries in the flight recorder (ULog) following module stop.

Detection Strategies

Enable AddressSanitizer (ASan) builds of PX4 in CI and simulation to catch the use-after-free during regression testing.
Instrument MAVLink shell endpoints to alert when privileged module control commands such as load_mon stop are received from unexpected ground control stations.
Correlate ULog telemetry for abrupt load_mon task termination with subsequent scheduler anomalies.

Monitoring Recommendations

Log and centrally collect MAVLink SHELL_COMMAND messages from all vehicles and ground stations.
Track PX4 firmware versions across the fleet and flag any unit running 1.17.0 or earlier.
Alert on unplanned in-flight autopilot reboots that follow shell command activity.

How to Mitigate CVE-2026-86713

Immediate Actions Required

Apply commit 354823e2efd8dd7ac47f4b8984b8e0fb06dc3b79 from the PX4 Autopilot Pull Request 28544 and rebuild firmware for all affected airframes.
Restrict MAVLink shell access to authenticated, trusted ground control stations only.
Audit deployed vehicles for firmware versions at or below 1.17.0 and schedule flashing before the next mission.

Patch Information

The fix is delivered by PX4 Autopilot Pull Request 28544, merged as commit 354823e2efd8dd7ac47f4b8984b8e0fb06dc3b79. The change reorders perf_end(_cycle_perf) to execute before exit_and_cleanup(desc) and adds a return to prevent any post-destruction access. Rebuild the affected target from a PX4 branch that includes this commit and reflash the vehicle. Refer to the VulnCheck Advisory on PX4 Autopilot for advisory context.

Workarounds

Disable or firewall the MAVLink shell (mavlink shell serial/UDP endpoints) on production vehicles until patched firmware is deployed.
Remove or restrict physical console access on companion computers exposing the PXH shell.
Operationally prohibit the load_mon stop command during flight and enforce this via ground-station command allowlists.

bash

# Example: disable MAVLink shell on the onboard channel in the PX4 startup script
# Edit ROMFS/px4fmu_common/init.d/rcS or the relevant airframe file
mavlink stop-all
mavlink start -x -u 14556 -r 4000000 -f -m onboard -o 14540
# Note: omit the '-x' flag to disable the file/shell channel entirely