---
id: "GHSA-56j9-g43f-8g6v"
kind: "vulnerability"
aliases: ["GHSA-56j9-g43f-8g6v"]
title: "CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["aws", "embedded", "firmware", "freertos", "lab-disclosure", "mcu", "runtime"]
not_affected_if: ["no-mpu-port", "queue-sets-disabled"]
published_at: "2026-10-30T00:00:00+00:00"
first_seen_at: "2026-10-30T18:01:07+00:00"
updated_at: "2026-10-30T18:01:14+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/", "first_seen_at": "2026-10-30T18:01:07+00:00"}]
---

# CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

FreeRTOS-Kernel, a real-time OS kernel for microcontrollers, does not fully check that a kernel object is a queue set before using it in xQueueSelectFromSet. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in privileged mode.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FreeRTOS-Kernel version in your firmware build, looking for versions `>=V7.4.0` and `<=V11.3.2`.
- Check whether `configUSE_QUEUE_SETS` is set to `1` and whether the port is MPU-enabled.
- Check any forked or vendored copies of the kernel, since the advisory says derivative code must also be patched.

## Fix

- FreeRTOS-Kernel: upgrade to `V11.3.3` or later, then rebuild and reflash affected firmware.

## Timeline

- 2026-10-30T18:01:07+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/ — AWS: CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

## Documents

- [advisory] AWS: CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel https://aws.amazon.com/security/security-bulletins/rss/2026-158-aws/

## From the sources

CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

### CVE-2026-119086 - Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

Bulletin ID: 2026-158-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/30/2026 10:30 AM PDT

Description:

FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.

Impacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)

Resolution:

This issue has been addressed in FreeRTOS-Kernel version V11.3.3. We recommend upgrading to FreeRTOS-Kernel V11.3.3 (or later), rebuilding, and reflashing affected firmware. Ensure any forked or derivative code is also patched to incorporate the fix.

Workarounds:

This issue does not affect builds that do not enable queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.

References:

- CVE-2026-119086
- GHSA-56j9-g43f-8g6v

Acknowledgement:

We would like to thank Claude (Anthropic) and Ada Logics for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_