---
id: "CVE-2026-109587"
kind: "vulnerability"
aliases: ["CVE-2026-109587"]
title: "Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FreeRTOS-Kernel", "fixed": ["11.3.2"], "affected": ">= 11.3.0, <= 11.3.1 (Cortex-R82 MPU port)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["armv8-r", "aws", "cortex-r82", "embedded", "freertos", "infrastructure", "lab-disclosure", "mpu", "privilege-escalation"]
not_affected_if: ["configenable_mpu-0", "mpu-disabled", "no-mpu", "not-cortex-r82", "other-kernel-version", "other-ports"]
published_at: "2026-10-16T00:00:00+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T19:12:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109587", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:32:03+00:00"}, {"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-138-aws/", "first_seen_at": "2026-10-24T19:12:58+00:00"}]
---

# Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1…

FreeRTOS-Kernel V11.3.0 and V11.3.1, Arm Cortex-R82 (Armv8-R AArch64) MPU port, builds with configENABLE_MPU=1: the port does not enforce the memory-region boundaries of an unprivileged task when it passes a buffer to an MPU system call. The task can read and write privileged kernel memory and break MPU task isolation. CWE-863. A sibling issue, CVE-2026-109588 (stream buffer length truncation), is fixed in the same release.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FreeRTOS-Kernel affected >= 11.3.0, <= 11.3.1 (Cortex-R82 MPU port) fixed 11.3.2

## How to check

Check whether you build FreeRTOS-Kernel for the Cortex-R82 port (portable/GCC/ARM_CR82 or equivalent) with configENABLE_MPU set to 1 in FreeRTOSConfig.h, and whether the kernel version (tasks.h tskKERNEL_VERSION_NUMBER) is V11.3.0 or V11.3.1. Other ports, and builds without the MPU, are not affected. Check forks and vendor SDKs that bundle the kernel too.

## Fix

Upgrade FreeRTOS-Kernel to V11.3.2 or later. Forks and vendor SDKs need to pick up the fix too. No workaround is documented.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109587
- 2026-10-23T23:32:03+00:00 analyst — Read AWS bulletin 2026-138-AWS, GHSA-pv9j-rq42-3fjc (assumed match by description; sibling CVE-2026-109588 is GHSA-qf4j-6f5j-876g) and CVE record. Affected V11.3.0-11.3.1 Cortex-R82 with configENABLE_MPU=1; fixed V11.3.2. No exploitation or PoC found; social search not done (niche embedded). CVSS 3.1 8.8 / 4.0 9.3. Reporters: Ada Logics, Anthropic.
- 2026-10-24T19:12:58+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-138-aws/ — AWS: CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel

## Documents

- [advisory] GHSA-pv9j-rq42-3fjc Arm Cortex-R82 MPU Region Limit Mask Inversion https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-pv9j-rq42-3fjc
- [advisory] AWS bulletin 2026-138-AWS https://aws.amazon.com/security/security-bulletins/2026-138-aws/
- [advisory] AWS: CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel https://aws.amazon.com/security/security-bulletins/rss/2026-138-aws/
- [fix] FreeRTOS-Kernel V11.3.2 https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.2

## From the sources

CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel

### CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel

Bulletin ID: 2026-138-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:00 AM PDT

Description:

FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. AWS identified two issues with the FreeRTOS-Kernel Arm Cortex-R82 (Armv8-R AArch64) MPU port, affecting multiple versions.

CVE-2026-109587: Incorrect authorization in the Arm Cortex-R82 MPU port. On MPU-enabled builds, the port does not correctly enforce the memory-region boundaries assigned to an unprivileged task when it passes a buffer argument to an MPU system call. Under certain conditions, an unprivileged task might read and write privileged kernel memory outside the regions assigned to it. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.

CVE-2026-109588: Numeric truncation in the MPU buffer authorization check on the Arm Cortex-R82 MPU port. On MPU-enabled builds, the buffer-length validation does not correctly account for the full length of a buffer passed to a stream buffer system call. Under certain conditions, an unprivileged task might read or write privileged kernel memory beyond the validated buffer window. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.

Impacted versions:

- CVE-2026-109587 (MPU region authorization): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1)
- CVE-2026-109588 (MPU buffer length truncation): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1)

Resolution:

This issue has been addressed in FreeRTOS-Kernel version V11.3.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

- CVE-2026-109587 (MPU region authorization): There is no risk when not using the FreeRTOS MPU on the Arm Cortex-R82 port. Where the Arm Cortex-R82 port and MPU feature are in use, upgrading to the fixed version is the recommended remediation.
- CVE-2026-109588 (MPU buffer length truncation): There is no risk when not using the FreeRTOS MPU on the Arm Cortex-R82 port. Where the Arm Cortex-R82 port and MPU feature are in use, upgrading to the fixed version is the recommended remediation.

References:

- CVE-2026-109587
- CVE-2026-109588
- GHSA-pv9j-rq42-3fjc
- GHSA-qf4j-6f5j-876g

Acknowledgement:

We would like to thank Ada Logics Ltd and Anthropic for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_