CVE-2026-109588
8.8HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-125, CWE-197, CWE-787
Impact
An unprivileged task can read or write privileged kernel memory to compromise the RTOS. An attacker needs local execution as an unprivileged task on an MPU-enabled build.
Root cause
Numeric truncation of the buffer length parameter occurs during MPU buffer authorization checks inside stream buffer system calls.
Affected systems
FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade FreeRTOS-Kernel to version V11.3.2 or later. No interim mitigation is provided.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call. To remediate this issue, users should upgrade to version V11.3.2 or later.