Live › vulnerability › CVE-2026-109587
Go to dashboardFreeRTOS-Kernel V11.3.0 and V11.3.1, Arm Cortex-R82 (Armv8-R AArch64) MPU port, builds with configENABLE_MPU=1: the port does not enforce the memory-region boundaries of an unprivileged task when it passes a buffer to an MPU system call. The task can read and write privileged kernel memory and break MPU task isolation. CWE-863. A sibling issue, CVE-2026-109588 (stream buffer length truncation), is fixed in the same release.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| FreeRTOS-Kernel | vendor | >= 11.3.0, <= 11.3.1 (Cortex-R82 MPU port) | 11.3.2 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel
Bulletin ID: 2026-138-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:00 AM PDT
Description:
FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. AWS identified two issues with the FreeRTOS-Kernel Arm Cortex-R82 (Armv8-R AArch64) MPU port, affecting multiple versions.
CVE-2026-109587: Incorrect authorization in the Arm Cortex-R82 MPU port. On MPU-enabled builds, the port does not correctly enforce the memory-region boundaries assigned to an unprivileged task when it passes a buffer argument to an MPU system call. Under certain conditions, an unprivileged task might read and write privileged kernel memory outside the regions assigned to it. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.
CVE-2026-109588: Numeric truncation in the MPU buffer authorization check on the Arm Cortex-R82 MPU port. On MPU-enabled builds, the buffer-length validation does not correctly account for the full length of a buffer passed to a stream buffer system call. Under certain conditions, an unprivileged task might read or write privileged kernel memory beyond the validated buffer window. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.
Impacted versions:
Resolution:
This issue has been addressed in FreeRTOS-Kernel version V11.3.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
References:
Acknowledgement:
We would like to thank Ada Logics Ltd and Anthropic for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-109587")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.