Live › vulnerability › GHSA-56j9-g43f-8g6v
FreeRTOS-Kernel, a real-time OS kernel for microcontrollers, does not fully check that a kernel object is a queue set before using it in xQueueSelectFromSet. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in privileged mode.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:01 UTC. All times on this page are UTC.
Only builds that use an MPU-enabled FreeRTOS port with queue sets turned on (configUSE_QUEUE_SETS=1) are exposed. Builds without queue sets are not affected, and forked or derivative copies of the kernel need the same patch.
No product ranges from the sources yet.
>=V7.4.0 and <=V11.3.2.configUSE_QUEUE_SETS is set to 1 and whether the port is MPU-enabled.V11.3.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel
Bulletin ID: 2026-158-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 10:30 AM PDT
Description:
FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.
Impacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)
Resolution:
This issue has been addressed in FreeRTOS-Kernel version V11.3.3. We recommend upgrading to FreeRTOS-Kernel V11.3.3 (or later), rebuilding, and reflashing affected firmware. Ensure any forked or derivative code is also patched to incorporate the fix.
Workarounds:
This issue does not affect builds that do not enable queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.
References:
Acknowledgement:
We would like to thank Claude (Anthropic) and Ada Logics for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-56j9-g43f-8g6v")