CVE-2026-109588: Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.
To remediate this issue, users should upgrade to version V11.3.2 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRTOS-Kernelto a version that resolves this vulnerability.Fixed in V11.3.2
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects FreeRTOS-Kernel V11.3.0 and V11.3.1 using the Arm Cortex-R82 (Armv8-R AArch64) MPU port, where MPU support is enabled.
What level of access does an attacker need?
An attacker needs the ability to run an unprivileged task on the affected MPU-enabled build. Exploitation is described through a stream buffer system call and does not require user interaction.
What is the potential impact of successful exploitation?
Under certain conditions, an unprivileged task may read or write privileged kernel memory outside the validated buffer window. This can affect confidentiality, integrity, and availability.
What should teams do to remediate the issue?
Upgrade FreeRTOS-Kernel to V11.3.2 or later.