FreeRTOS-Kernel: Numeric truncation in MPU buffer authorization check
Summary
In FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 MPU port, a numeric truncation in the buffer length check of a stream buffer system call can allow an unprivileged task to read or write privileged kernel memory beyond the validated buffer window. The attacker needs code execution as an unprivileged task on the device, so the flaw is local and not reachable from the network. It only applies to MPU-enabled builds (configENABLE_MPU=1).
Affected
- FreeRTOS-Kernel V11.3.0 and V11.3.1
- Arm Cortex-R82 builds with configENABLE_MPU=1
- Applications not using the FreeRTOS MPU are not affected
Fixed in
- Upgrade to FreeRTOS-Kernel V11.3.2 or later
- Also patch any forked or derivative code
Workaround
- Not using the FreeRTOS MPU on the Arm Cortex-R82 port removes the risk (configuration-based mitigation, not a fix)
Exploitation
- No evidence of in-the-wild exploitation found
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- No public proof of concept found
Our recommendation
- Check whether any device or firmware you use or build runs FreeRTOS on Cortex-R82 with the MPU enabled
- Ask device vendors whether their firmware uses V11.3.0 or V11.3.1 with the MPU enabled and request an update to V11.3.2 or later
- Verify fixes by checking out the git tag V11.3.2 rather than relying on the release zip
- Note that the CVSS 9.3 score overstates practical risk for typical SME environments; no action is needed if no such devices are in use
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-138-AWS aws.amazon.com
- FreeRTOS-Kernel Release V11.3.2 github.com
- GitHub Security Advisory GHSA-qf4j-6f5j-876g github.com
- Strix CVE record CVE-2026-109588 www.strix.ai
- Vulners CVE record CVE-2026-109588 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:31.
Original description (NVD)
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call. To remediate this issue, users should upgrade to version V11.3.2 or later.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.