FreeRTOS-Kernel: Incorrect authorization in Arm Cortex-R82 MPU port
Summary
FreeRTOS-Kernel versions V11.3.0 and V11.3.1 on Arm Cortex-R82 builds with the MPU enabled (configENABLE_MPU=1) do not correctly enforce memory-region boundaries when a buffer is passed to an MPU system call. An unprivileged task could read and write privileged kernel memory outside its assigned regions. An attacker needs code execution in an unprivileged task on the device first, and applications that do not use the FreeRTOS MPU are not affected.
Affected
- FreeRTOS-Kernel V11.3.0 and V11.3.1
- Arm Cortex-R82 (Armv8-R AArch64) MPU port with configENABLE_MPU=1
- Applications that do not use the FreeRTOS MPU are not affected.
Fixed in
- FreeRTOS-Kernel V11.3.2 or later
Workaround
- No vendor workaround is documented. Vendor states there is no risk where the FreeRTOS MPU is not used on the Cortex-R82 port.
Exploitation
- No known exploitation found.
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether any devices or in-house firmware use FreeRTOS-Kernel 11.3.0 or 11.3.1 on Cortex-R82 with the MPU enabled.
- Ask device and firmware vendors to confirm and provide firmware based on V11.3.2 or later.
- Upgrade in-house builds and dependency manifests to V11.3.2 from the tag or commit, not the ZIP asset, and verify the version in the code.
- Low relevance for typical office IT; no action needed where the affected configuration is not used.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-138-AWS aws.amazon.com
- FreeRTOS-Kernel Release V11.3.2 github.com
- GitHub Security Advisory GHSA-pv9j-rq42-3fjc github.com
- Strix CVE-2026-109587 www.strix.ai
- VulDB entry 421357 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:30.
Original description (NVD)
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.