Live › vulnerability › CVE-2026-119086
FreeRTOS-Kernel does not fully check that a kernel object is a queue set before using it in xQueueSelectFromSet, on MPU-enabled builds with queue sets enabled. An unprivileged task can make the kernel write beyond the intended destination while running in privileged context, which harms the integrity of privileged execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:01 UTC, 1h before NVD. All times on this page are UTC.
Only builds that use an MPU-enabled port with queue sets turned on (configUSE_QUEUE_SETS=1) are exposed; builds without queue sets are not affected. Teams running firmware on microcontrollers that embed FreeRTOS should look at their kernel version and configuration, and at any forked copies of the kernel. Teams that do not enable queue sets can skip it.
No product ranges from the sources yet.
>=V7.4.0 and <=V11.3.2 to be affected.configUSE_QUEUE_SETS is set to 1 in FreeRTOSConfig.h.V11.3.3 or later, then rebuild and reflash affected firmware.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel
Bulletin ID: 2026-158-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 10:30 AM PDT
Description:
FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.
Impacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)
Resolution:
This issue has been addressed in FreeRTOS-Kernel version V11.3.3. We recommend upgrading to FreeRTOS-Kernel V11.3.3 (or later), rebuilding, and reflashing affected firmware. Ensure any forked or derivative code is also patched to incorporate the fix.
Workarounds:
This issue does not affect builds that do not enable queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.
References:
Acknowledgement:
We would like to thank Claude (Anthropic) and Ada Logics for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-119086")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.