{"id":"CVE-2026-119086","kind":"vulnerability","aliases":["CVE-2026-119086"],"related":[],"title":"Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on…","description":"CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel\n\n### CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel\n\nBulletin ID: 2026-158-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 10:30 AM PDT\n\nDescription:\n\nFreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.\n\nImpacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Kernel version V11.3.3. We recommend upgrading to FreeRTOS-Kernel V11.3.3 (or later), rebuilding, and reflashing affected firmware. Ensure any forked or derivative code is also patched to incorporate the fix.\n\nWorkarounds:\n\nThis issue does not affect builds that do not enable queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.\n\nReferences:\n\n- CVE-2026-119086\n- GHSA-56j9-g43f-8g6v\n\nAcknowledgement:\n\nWe would like to thank Claude (Anthropic) and Ada Logics for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"FreeRTOS-Kernel does not fully check that a kernel object is a queue set before using it in xQueueSelectFromSet, on MPU-enabled builds with queue sets enabled. An unprivileged task can make the kernel write beyond the intended destination while running in privileged context, which harms the integrity of privileged execution.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","embedded","firmware","freertos","lab-disclosure","microcontrollers","mpu","runtime"],"not_affected_if":["no-mpu-port","queue-sets-disabled"],"how_to_check":"- Check the FreeRTOS-Kernel version in your firmware build, which should be `>=V7.4.0` and `<=V11.3.2` to be affected.\n- Check that the port uses an MPU and that `configUSE_QUEUE_SETS` is set to `1` in `FreeRTOSConfig.h`.\n- Check for forked or vendored copies of the kernel code, since derivative code must also be patched.","fix":"- FreeRTOS-Kernel `V11.3.3` or later, then rebuild and reflash affected firmware.\n- Patch any forked or derivative code to incorporate the fix.","status":"open","published_at":"2026-10-30T00:00:00+00:00","first_seen_at":"2026-10-30T18:01:07+00:00","triaged_at":"2026-10-30T18:01:14+00:00","updated_at":"2026-10-30T18:55:43+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-30T18:01:14Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRTOS-Kernel `V11.3.3` or later, then rebuild and reflash affected firmware.\n- Patch any forked or derivative code to incorporate the fix.","reach":"local","title":"FreeRTOS kernel: queue-set flaw lets unprivileged tasks write beyond bounds","impact":"medium","summary":"FreeRTOS-Kernel does not fully check that a kernel object is a queue set before using it in xQueueSelectFromSet, on MPU-enabled builds with queue sets enabled. An unprivileged task can make the kernel write beyond the intended destination while running in privileged context, which harms the integrity of privileged execution.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["freertos","embedded","microcontrollers","firmware","mpu"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"unprivileged task corrupts memory during privileged kernel operations","analyst_note":"","how_to_check":"- Check the FreeRTOS-Kernel version in your firmware build, which should be `>=V7.4.0` and `<=V11.3.2` to be affected.\n- Check that the port uses an MPU and that `configUSE_QUEUE_SETS` is set to `1` in `FreeRTOSConfig.h`.\n- Check for forked or vendored copies of the kernel code, since derivative code must also be patched.","plain_action":"","needs_analyst":false,"not_affected_if":["queue-sets-disabled","no-mpu-port"],"who_is_affected":"Only builds that use an MPU-enabled port with queue sets turned on (`configUSE_QUEUE_SETS=1`) are exposed; builds without queue sets are not affected. Teams running firmware on microcontrollers that embed FreeRTOS should look at their kernel version and configuration, and at any forked copies of the kernel. Teams that do not enable queue sets can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000831,"input_tokens":4748,"output_tokens":713,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119086':23A,26A,92C,104C,157C,309C '-158':117C '-2026':22A,25A,91C,103C,156C,308C '1':239C '10':129C '10/30/2026':128C '2026':116C '30':130C '56j9':312C '8g6v':314C 'acknowledg':315C 'ada':324C 'address':245C 'affect':210C,225C,265C,285C 'also':274C 'amazon':152C 'anthrop':322C 'applic':216C 'attent':125C 'aw':27B,118C,120C 'aws-security@amazon.com':339C 'beyond':74B,199C 'build':61B,185C,286C 'built':219C 'bulletin':114C 'call':14A 'caus':194C 'check':43B 'claud':321C 'code':272C 'collabor':327C 'concern':345C 'configus':236C 'content':121C 'context':82B,208C 'coordin':333C 'cve':21A,24A,90C,102C,155C,307C 'date':127C 'deriv':271C 'descript':133C 'destin':77B,202C 'disclosur':33B,335C 'distribut':150C 'email':338C 'embed':28B 'enabl':60B,65B,184C,189C,233C,290C 'ensur':267C 'execut':89B,204C,215C 'firmwar':29B,266C 'fix':279C,300C 'fork':269C 'freerto':17A,30B,38B,100C,112C,135C,248C,257C 'freertos-kernel':16A,37B,99C,111C,134C,247C,256C 'fulli':42B,166C 'g43f':313C 'ghsa':311C 'ghsa-56j9-g43f-8g6v':310C 'harm':84B 'id':115C 'identifi':154C 'impact':226C 'import':123C 'incorpor':277C 'integr':86B,212C 'intend':76B,201C 'issu':242C,282C,330C 'kernel':18A,39B,46B,72B,101C,113C,136C,144C,171C,196C,249C,258C 'lab':32B 'lab-disclosur':31B 'later':261C 'like':318C 'logic':325C 'make':70B 'microcontrol':34B,146C 'microprocessor':149C 'miss':1A,93C,105C 'mpu':35B,59B,183C,232C 'mpu-en':58B,182C,231C 'object':47B,172C 'oper':142C,178C 'patch':275C 'path':163C 'pdt':132C 'pleas':337C 'port':234C 'privileg':81B,88B,207C,214C 'process':336C 'public':126C 'question':343C 'queue':3A,10A,50B,63B,160C,175C,187C,221C,237C,291C,295C 'queue-set':2A,9A,159C 'real':140C 'real-tim':139C 'rebuild':262C 'recommend':253C,304C 'refer':306C 'referenc':170C 'reflash':264C 'remedi':305C 'requir':124C 'resolut':240C 'run':79B 'runtim':36B 'scope':119C 'secur':342C 'select':12A,162C 'set':4A,11A,51B,64B,161C,176C,188C,222C,238C,292C,296C 'small':148C 'system':13A,143C 'task':68B,192C 'thank':320C 'time':141C 'type':5A,94C,106C,122C 'unprivileg':67B,191C 'upgrad':254C,297C 'use':53B,294C 'v11.3.2':230C 'v11.3.3':20A,251C,259C 'v7.4.0':228C 'valid':6A,95C,107C,167C 'version':227C,250C,301C 'vulner':334C 'without':220C 'workaround':280C 'would':317C 'write':73B,198C 'xqueueselectfromset':56B,97C,109C","nicknames":[],"mitigations":[],"who_affected":"Only builds that use an MPU-enabled port with queue sets turned on (`configUSE_QUEUE_SETS=1`) are exposed; builds without queue sets are not affected. Teams running firmware on microcontrollers that embed FreeRTOS should look at their kernel version and configuration, and at any forked copies of the kernel. Teams that do not enable queue sets can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/#CVE-2026-119086","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/","severity":null,"published_at":"2026-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-30T18:01:07+00:00","fetched_at":"2026-10-30T18:01:07+00:00","note":"AWS: CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel"},{"source":"nvd","external_id":"CVE-2026-119086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119086","severity":null,"published_at":"2026-10-30T18:17:25+00:00","modified_at":"2026-10-30T18:17:25+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:30+00:00","note":null}],"documents":[{"id":25043,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/","title":"AWS: CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel\n\n### CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel\n\nBulletin ID: 2026-158-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 10:30 AM PDT\n\nDescription:\n\nFreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.\n\nImpacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Kernel version V11.3.3. We recommend upgrading to FreeRTOS-Kernel V11.3.3 (or later), rebuilding, and reflashing affected firmware. Ensure any forked or derivative code is also patched to incorporate the fix.\n\nWorkarounds:\n\nThis issue does not affect builds that do not enable queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.\n\nReferences:\n\n- CVE-2026-119086\n- GHSA-56j9-g43f-8g6v\n\nAcknowledgement:\n\nWe would like to thank Claude (Anthropic) and Ada Logics for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-30T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}