FreeRTOS-Kernel CVE-2026-109587

Requires an MPU-enabled build of FreeRTOS-Kernel V11.3.0 or V11.3.1 running specifically on the Arm Cortex-R82 (Armv8-R AArch64) MPU port, and the attacker must already be able to execute an unprivileged task on the device and invoke an MPU system call with an attacker-controlled buffer argument pointing outside its assigned regions. Limiting factors: exploitation is local only (no remote/network reach), it requires pre-existing unprivileged code execution (PR:L), it does not apply to non-MPU builds or to other CPU/port targets, and it is fixed in V11.3.2 - so only the specific vulnerable port+version+MPU-mode combination is at risk.

All severity signals point the same direction but are tempered by exploitation prerequisites. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 9.3 Critical because the vulnerable-system AND subsequent-system impacts are all High (VC/VI/VA:H, SC/SI/SA:H) - reflecting that an unprivileged task can read and write privileged kernel memory, a full confidentiality/integrity/availability compromise and a security-boundary (scope) crossing. The key limiter is that the attack is LOCAL (AV:L) and requires existing low-privilege code execution (PR:L), so this is a local privilege-escalation / memory-isolation bypass, not a remotely reachable flaw. No EPSS score, no SSVC decision data, and no POC were provided, and there is no CISA KEV listing, so there is no evidence of active or automatable exploitation - exploitation status is 'no public exploit identified at time of analysis.' Net: a genuinely high-impact issue for the specific affected configuration (Arm Cortex-R82 Armv8-R AArch64 MPU port, MPU-enabled builds) where MPU isolation is a core security guarantee, but real-world reach is constrained by the local vector, the narrow affected hardware port, and the absence of any exploitation telemetry. Treat as high priority for devices actually running the affected port; broad fleet-wide urgency is not supported by the available signals.

On a device running an MPU-enabled FreeRTOS-Kernel V11.3.0/V11.3.1 build for the Arm Cortex-R82 (Armv8-R AArch64) port, an attacker who already controls an unprivileged task invokes an MPU system call and passes a crafted buffer argument that points outside the task's assigned memory regions. Because the authorization check on that buffer is incorrect (CWE-863), the kernel reads from or writes to privileged memory on the task's behalf, letting the attacker escalate to kernel privilege. No public exploit code was identified in the provided data.