{"id":"GHSA-56j9-g43f-8g6v","kind":"vulnerability","aliases":["GHSA-56j9-g43f-8g6v"],"related":[],"title":"CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel","description":"CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel\n\n### CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel\n\nBulletin ID: 2026-158-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 10:30 AM PDT\n\nDescription:\n\nFreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.\n\nImpacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Kernel version V11.3.3. We recommend upgrading to FreeRTOS-Kernel V11.3.3 (or later), rebuilding, and reflashing affected firmware. Ensure any forked or derivative code is also patched to incorporate the fix.\n\nWorkarounds:\n\nThis issue does not affect builds that do not enable queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.\n\nReferences:\n\n- CVE-2026-119086\n- GHSA-56j9-g43f-8g6v\n\nAcknowledgement:\n\nWe would like to thank Claude (Anthropic) and Ada Logics for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"FreeRTOS-Kernel, a real-time OS kernel for microcontrollers, does not fully check that a kernel object is a queue set before using it in xQueueSelectFromSet. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in privileged mode.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","embedded","firmware","freertos","lab-disclosure","mcu","runtime"],"not_affected_if":["no-mpu-port","queue-sets-disabled"],"how_to_check":"- Check the FreeRTOS-Kernel version in your firmware build, looking for versions `>=V7.4.0` and `<=V11.3.2`.\n- Check whether `configUSE_QUEUE_SETS` is set to `1` and whether the port is MPU-enabled.\n- Check any forked or vendored copies of the kernel, since the advisory says derivative code must also be patched.","fix":"- FreeRTOS-Kernel: upgrade to `V11.3.3` or later, then rebuild and reflash affected firmware.","status":"open","published_at":"2026-10-30T00:00:00+00:00","first_seen_at":"2026-10-30T18:01:07+00:00","triaged_at":"2026-10-30T18:01:14+00:00","updated_at":"2026-10-30T18:01:14+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-30T18:01:14Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRTOS-Kernel: upgrade to `V11.3.3` or later, then rebuild and reflash affected firmware.","reach":"local","title":"FreeRTOS-Kernel: unprivileged task can write past buffers in queue-set selection","impact":"high","summary":"FreeRTOS-Kernel, a real-time OS kernel for microcontrollers, does not fully check that a kernel object is a queue set before using it in xQueueSelectFromSet. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in privileged mode.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["freertos","embedded","firmware","mcu"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"unprivileged task corrupts memory during privileged kernel execution","analyst_note":"","how_to_check":"- Check the FreeRTOS-Kernel version in your firmware build, looking for versions `>=V7.4.0` and `<=V11.3.2`.\n- Check whether `configUSE_QUEUE_SETS` is set to `1` and whether the port is MPU-enabled.\n- Check any forked or vendored copies of the kernel, since the advisory says derivative code must also be patched.","plain_action":"","needs_analyst":false,"not_affected_if":["queue-sets-disabled","no-mpu-port"],"who_is_affected":"Only builds that use an MPU-enabled FreeRTOS port with queue sets turned on (`configUSE_QUEUE_SETS=1`) are exposed. Builds without queue sets are not affected, and forked or derivative copies of the kernel need the same patch.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000797,"input_tokens":4764,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-119086':3A,88C,100C,153C,305C '-158':113C '-2026':2A,87C,99C,152C,304C '1':235C '10':125C '10/30/2026':124C '2026':112C '30':126C '56j9':15A,20A,308C '8g6v':17A,22A,310C 'acknowledg':311C 'ada':320C 'address':241C 'affect':206C,221C,261C,281C 'also':270C 'amazon':148C 'anthrop':318C 'applic':212C 'attent':121C 'aw':23B,114C,116C 'aws-security@amazon.com':335C 'beyond':77B,195C 'build':64B,181C,282C 'built':215C 'bulletin':110C 'caus':190C 'check':46B 'claud':317C 'code':268C 'collabor':323C 'concern':341C 'configus':232C 'content':117C 'context':204C 'coordin':329C 'cve':1A,86C,98C,151C,303C 'date':123C 'deriv':267C 'descript':129C 'destin':80B,198C 'disclosur':29B,331C 'distribut':146C 'email':334C 'embed':24B 'enabl':63B,68B,180C,185C,229C,286C 'ensur':263C 'execut':200C,211C 'firmwar':25B,262C 'fix':275C,296C 'fork':265C 'freerto':11A,26B,33B,96C,108C,131C,244C,253C 'freertos-kernel':10A,32B,95C,107C,130C,243C,252C 'fulli':45B,162C 'g43f':16A,21A,309C 'ghsa':14A,19A,307C 'ghsa-56j9-g43f-8g6v':13A,18A,306C 'id':111C 'identifi':150C 'impact':222C 'import':119C 'incorpor':273C 'integr':208C 'intend':79B,197C 'issu':238C,278C,326C 'kernel':12A,34B,40B,49B,75B,97C,109C,132C,140C,167C,192C,245C,254C 'lab':28B 'lab-disclosur':27B 'later':257C 'like':314C 'logic':321C 'make':73B 'mcu':30B 'microcontrol':42B,142C 'microprocessor':145C 'miss':4A,89C,101C 'mode':85B 'mpu':62B,179C,228C 'mpu-en':61B,178C,227C 'object':50B,168C 'oper':138C,174C 'os':39B 'patch':271C 'path':159C 'pdt':128C 'pleas':333C 'port':230C 'privileg':84B,203C,210C 'process':332C 'public':122C 'question':339C 'queue':53B,66B,156C,171C,183C,217C,233C,287C,291C 'queue-set':155C 'real':37B,136C 'real-tim':36B,135C 'rebuild':258C 'recommend':249C,300C 'refer':302C 'referenc':166C 'reflash':260C 'remedi':301C 'requir':120C 'resolut':236C 'run':82B 'runtim':31B 'scope':115C 'secur':338C 'select':158C 'set':54B,67B,157C,172C,184C,218C,234C,288C,292C 'small':144C 'system':139C 'task':71B,188C 'thank':316C 'time':38B,137C 'type':5A,90C,102C,118C 'unprivileg':70B,187C 'upgrad':250C,293C 'use':56B,290C 'v11.3.2':226C 'v11.3.3':247C,255C 'v7.4.0':224C 'valid':6A,91C,103C,163C 'version':223C,246C,297C 'vulner':330C 'without':216C 'workaround':276C 'would':313C 'write':76B,194C 'xqueueselectfromset':8A,59B,93C,105C","nicknames":[],"mitigations":[],"who_affected":"Only builds that use an MPU-enabled FreeRTOS port with queue sets turned on (`configUSE_QUEUE_SETS=1`) are exposed. Builds without queue sets are not affected, and forked or derivative copies of the kernel need the same patch.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/#GHSA-56j9-g43f-8g6v","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/","severity":null,"published_at":"2026-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-30T18:01:07+00:00","fetched_at":"2026-10-30T18:01:07+00:00","note":"AWS: CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel"}],"documents":[{"id":25043,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/","title":"AWS: CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel\n\n### CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel\n\nBulletin ID: 2026-158-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 10:30 AM PDT\n\nDescription:\n\nFreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.\n\nImpacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Kernel version V11.3.3. We recommend upgrading to FreeRTOS-Kernel V11.3.3 (or later), rebuilding, and reflashing affected firmware. Ensure any forked or derivative code is also patched to incorporate the fix.\n\nWorkarounds:\n\nThis issue does not affect builds that do not enable queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.\n\nReferences:\n\n- CVE-2026-119086\n- GHSA-56j9-g43f-8g6v\n\nAcknowledgement:\n\nWe would like to thank Claude (Anthropic) and Ada Logics for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-30T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}