CVE-2026-77235: Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel
Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation.
To remediate this issue, users should upgrade to version 11.3.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRTOS-Kernel deployments running versions earlier than 11.3.1 are affected if local users can invoke the SVC handler used for secure context deallocation. The issue involves secure-world memory.
What access does an attacker need?
An attacker needs local access and low privileges. No user interaction is required.
What can exploitation do?
Exploitation may cause a use-after-free condition in secure-world memory. The reported impact includes integrity loss and high availability impact.
How should this be remediated?
Upgrade FreeRTOS-Kernel to version 11.3.1 or later.