{"id":"GHSA-pv9j-rq42-3fjc","kind":"vulnerability","aliases":["GHSA-pv9j-rq42-3fjc"],"related":[],"title":"CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel","description":"CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel\n\n### CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel\n\nBulletin ID: 2026-138-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:00 AM PDT\n\nDescription:\n\nFreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. AWS identified two issues with the FreeRTOS-Kernel Arm Cortex-R82 (Armv8-R AArch64) MPU port, affecting multiple versions.\n\nCVE-2026-109587: Incorrect authorization in the Arm Cortex-R82 MPU port. On MPU-enabled builds, the port does not correctly enforce the memory-region boundaries assigned to an unprivileged task when it passes a buffer argument to an MPU system call. Under certain conditions, an unprivileged task might read and write privileged kernel memory outside the regions assigned to it. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.\n\nCVE-2026-109588: Numeric truncation in the MPU buffer authorization check on the Arm Cortex-R82 MPU port. On MPU-enabled builds, the buffer-length validation does not correctly account for the full length of a buffer passed to a stream buffer system call. Under certain conditions, an unprivileged task might read or write privileged kernel memory beyond the validated buffer window. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.\n\nImpacted versions:\n\n- CVE-2026-109587 (MPU region authorization): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1)\n- CVE-2026-109588 (MPU buffer length truncation): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1)\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Kernel version V11.3.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\n- CVE-2026-109587 (MPU region authorization): There is no risk when not using the FreeRTOS MPU on the Arm Cortex-R82 port. Where the Arm Cortex-R82 port and MPU feature are in use, upgrading to the fixed version is the recommended remediation.\n- CVE-2026-109588 (MPU buffer length truncation): There is no risk when not using the FreeRTOS MPU on the Arm Cortex-R82 port. Where the Arm Cortex-R82 port and MPU feature are in use, upgrading to the fixed version is the recommended remediation.\n\nReferences:\n\n- CVE-2026-109587\n- CVE-2026-109588\n- GHSA-pv9j-rq42-3fjc\n- GHSA-qf4j-6f5j-876g\n\nAcknowledgement:\n\nWe would like to thank Ada Logics Ltd and Anthropic for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"FreeRTOS-Kernel's Arm Cortex-R82 MPU port fails to enforce memory-region boundaries on buffer arguments passed to MPU system calls, and a stream buffer length check truncates large lengths. An unprivileged task can read and write privileged kernel memory outside its assigned regions.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-cortex-r82","aws","embedded","firmware","freertos","lab-disclosure","runtime"],"not_affected_if":["default-config","mpu-disabled","non-cortex-r82-port"],"how_to_check":"- Check whether the build uses the Cortex-R82 port with `configENABLE_MPU=1` in `FreeRTOSConfig.h`\n- Check the FreeRTOS-Kernel version in use; affected versions are `V11.3.0` and `V11.3.1`","fix":"- Upgrade FreeRTOS-Kernel to `V11.3.2`\n- Patch any forked or derivative copies of the kernel with the same fixes","status":"open","published_at":"2026-10-16T00:00:00+00:00","first_seen_at":"2026-10-24T19:12:58+00:00","triaged_at":"2026-10-25T05:27:47+00:00","updated_at":"2026-10-25T05:27:47+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T05:27:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRTOS-Kernel to `V11.3.2`\n- Patch any forked or derivative copies of the kernel with the same fixes","reach":"local","title":"FreeRTOS-Kernel: unprivileged tasks can reach privileged kernel memory on Cortex-R82","impact":"high","summary":"FreeRTOS-Kernel's Arm Cortex-R82 MPU port fails to enforce memory-region boundaries on buffer arguments passed to MPU system calls, and a stream buffer length check truncates large lengths. An unprivileged task can read and write privileged kernel memory outside its assigned regions.","category":"runtime","nicknames":[],"who_cares":["freertos","embedded","arm-cortex-r82","firmware"],"confidence":0.8,"needs_auth":"yes","worst_case":"unprivileged task reads and writes privileged kernel memory","analyst_note":"","how_to_check":"- Check whether the build uses the Cortex-R82 port with `configENABLE_MPU=1` in `FreeRTOSConfig.h`\n- Check the FreeRTOS-Kernel version in use; affected versions are `V11.3.0` and `V11.3.1`","needs_analyst":false,"not_affected_if":["default-config","non-cortex-r82-port","mpu-disabled"],"who_is_affected":"Only Arm Cortex-R82 (Armv8-R AArch64) builds of FreeRTOS-Kernel `V11.3.0` and `V11.3.1` with `configENABLE_MPU=1` are exposed. Applications that do not use the FreeRTOS MPU on that port are not affected, and neither are other ports according to the bulletin.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000766,"input_tokens":4526,"output_tokens":627,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109587':3A,84C,95C,167C,344C,415C,507C '-109588':6A,87C,98C,254C,362C,460C,510C '-138':107C '-2026':2A,5A,83C,86C,94C,97C,166C,253C,343C,361C,414C,459C,506C,509C '00':120C '1':240C,328C,359C,378C '10':119C '10/16/2026':118C '2026':106C '3fjc':16A,21A,515C '6f5j':519C '876g':520C 'aarch64':159C 'account':284C 'acknowledg':521C 'ada':527C 'address':384C 'affect':162C,231C,251C,319C,339C 'amazon':142C 'anthrop':531C 'applic':241C,329C 'argument':53B,204C 'arm':23B,38B,152C,172C,232C,265C,320C,351C,370C,431C,438C,477C,484C 'arm-cortex-r82':22B 'armv8':157C 'armv8-r':156C 'assign':80B,194C,226C 'attent':115C 'author':169C,261C,347C,418C 'aw':26B,108C,110C,143C 'aws-security@amazon.com':545C 'beyond':312C 'boundari':50B,193C 'buffer':52B,62B,203C,260C,278C,291C,296C,315C,364C,462C 'buffer-length':277C 'build':182C,236C,275C,324C,355C,374C 'bulletin':104C 'call':58B,209C,298C 'certain':211C,300C 'check':64B,262C 'code':404C 'collabor':533C 'concern':551C 'condit':212C,301C 'configen':238C,326C,357C,376C 'content':111C 'coordin':539C 'correct':187C,283C 'cortex':24B,40B,154C,174C,234C,267C,322C,353C,372C,433C,440C,479C,486C 'cortex-r82':39B,153C,173C,233C,266C,321C,352C,371C,432C,439C,478C,485C 'cve':1A,4A,82C,85C,93C,96C,165C,252C,342C,360C,413C,458C,505C,508C 'date':117C 'deriv':403C 'descript':123C 'disclosur':32B,541C 'distribut':140C 'email':544C 'embed':27B 'enabl':181C,274C 'enforc':46B,188C 'ensur':399C 'fail':44B 'featur':445C,491C 'firmwar':28B 'fix':411C,452C,498C 'fork':401C 'freerto':10A,29B,35B,91C,102C,125C,150C,247C,335C,387C,427C,473C 'freertos-kernel':9A,34B,90C,101C,124C,149C,386C 'full':287C 'ghsa':13A,18A,512C,517C 'ghsa-pv9j-rq42-3fjc':12A,17A,511C 'ghsa-qf4j-6f5j-876g':516C 'id':105C 'identifi':144C 'impact':340C 'import':113C 'incorpor':408C 'incorrect':168C 'issu':7A,88C,99C,146C,230C,318C,381C,536C 'kernel':11A,36B,76B,92C,103C,126C,134C,151C,221C,310C,388C 'lab':31B 'lab-disclosur':30B 'larg':66B 'latest':396C 'length':63B,67B,279C,288C,365C,463C 'like':524C 'logic':528C 'ltd':529C 'memori':48B,77B,191C,222C,311C 'memory-region':47B,190C 'microcontrol':136C 'microprocessor':139C 'might':216C,305C 'mpu':42B,56B,160C,176C,180C,207C,239C,248C,259C,269C,273C,327C,336C,345C,358C,363C,377C,416C,428C,444C,461C,474C,490C 'mpu-en':179C,272C 'multipl':163C 'new':410C 'numer':255C 'oper':132C 'outsid':78B,223C 'pass':54B,201C,292C 'patch':406C 'pdt':122C 'pleas':543C 'port':43B,161C,177C,184C,270C,435C,442C,481C,488C 'privileg':75B,220C,309C 'process':542C 'public':116C 'pv9j':14A,19A,513C 'qf4j':518C 'question':549C 'r':158C 'r82':25B,41B,155C,175C,235C,268C,323C,354C,373C,434C,441C,480C,487C 'read':72B,217C,306C 'real':130C 'real-tim':129C 'recommend':392C,456C,502C 'refer':504C 'region':49B,81B,192C,225C,346C,417C 'remedi':457C,503C 'requir':114C 'resolut':379C 'risk':422C,468C 'rq42':15A,20A,514C 'runtim':33B 'scope':109C 'secur':548C 'small':138C 'stream':61B,295C 'system':57B,133C,208C,297C 'task':70B,198C,215C,304C 'thank':526C 'time':131C 'truncat':65B,256C,366C,464C 'two':145C 'type':112C 'unprivileg':69B,197C,214C,303C 'upgrad':393C,449C,495C 'use':245C,333C,425C,448C,471C,494C 'v11.3.0':348C,367C 'v11.3.1':350C,369C 'v11.3.2':390C 'valid':280C,314C 'version':164C,341C,389C,397C,453C,499C 'vulner':540C 'window':316C 'workaround':412C 'would':523C 'write':74B,219C,308C","nicknames":[],"mitigations":[],"who_affected":"Only Arm Cortex-R82 (Armv8-R AArch64) builds of FreeRTOS-Kernel `V11.3.0` and `V11.3.1` with `configENABLE_MPU=1` are exposed. Applications that do not use the FreeRTOS MPU on that port are not affected, and neither are other ports according to the bulletin.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-138-aws/#GHSA-pv9j-rq42-3fjc","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-138-aws/","severity":null,"published_at":"2026-10-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:58+00:00","fetched_at":"2026-10-24T22:06:10+00:00","note":"AWS: CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel"}],"documents":[{"id":2024,"url":"https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-pv9j-rq42-3fjc","title":"GHSA-pv9j-rq42-3fjc Arm Cortex-R82 MPU Region Limit Mask Inversion","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2932,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-138-aws/","title":"AWS: CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel","kind":"advisory","source":"lab","text":"CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel\n\n### CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel\n\nBulletin ID: 2026-138-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:00 AM PDT\n\nDescription:\n\nFreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. AWS identified two issues with the FreeRTOS-Kernel Arm Cortex-R82 (Armv8-R AArch64) MPU port, affecting multiple versions.\n\nCVE-2026-109587: Incorrect authorization in the Arm Cortex-R82 MPU port. On MPU-enabled builds, the port does not correctly enforce the memory-region boundaries assigned to an unprivileged task when it passes a buffer argument to an MPU system call. Under certain conditions, an unprivileged task might read and write privileged kernel memory outside the regions assigned to it. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.\n\nCVE-2026-109588: Numeric truncation in the MPU buffer authorization check on the Arm Cortex-R82 MPU port. On MPU-enabled builds, the buffer-length validation does not correctly account for the full length of a buffer passed to a stream buffer system call. Under certain conditions, an unprivileged task might read or write privileged kernel memory beyond the validated buffer window. This issue affects Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use the FreeRTOS MPU are not affected.\n\nImpacted versions:\n\n- CVE-2026-109587 (MPU region authorization): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1)\n- CVE-2026-109588 (MPU buffer length truncation): V11.3.0 and V11.3.1 (Arm Cortex-R82 builds with configENABLE_MPU=1)\n\nResolution:\n\nThis issue has been addressed in FreeRTOS-Kernel version V11.3.2. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\n- CVE-2026-109587 (MPU region authorization): There is no risk when not using the FreeRTOS MPU on the Arm Cortex-R82 port. Where the Arm Cortex-R82 port and MPU feature are in use, upgrading to the fixed version is the recommended remediation.\n- CVE-2026-109588 (MPU buffer length truncation): There is no risk when not using the FreeRTOS MPU on the Arm Cortex-R82 port. Where the Arm Cortex-R82 port and MPU feature are in use, upgrading to the fixed version is the recommended remediation.\n\nReferences:\n\n- CVE-2026-109587\n- CVE-2026-109588\n- GHSA-pv9j-rq42-3fjc\n- GHSA-qf4j-6f5j-876g\n\nAcknowledgement:\n\nWe would like to thank Ada Logics Ltd and Anthropic for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-10-16T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}