FreeRTOS-Kernel CVE-2026-109588

Exploitation requires a very specific configuration: an MPU-enabled FreeRTOS-Kernel build at version V11.3.0 or V11.3.1, running the Arm Cortex-R82 (Armv8-R AArch64) MPU port, where the attacker can already execute an unprivileged task that can issue stream buffer system calls. The vulnerability is in the MPU buffer authorization check, so it only applies to MPU-enabled builds on that AArch64 port - non-MPU builds, other architectures/ports, and other kernel versions are not affected. Limiting factors: no remote vector (attacker must have local unprivileged code execution on the device), the flaw triggers only 'under certain conditions' tied to buffer lengths that cause numeric truncation, and the affected hardware port is new and narrowly deployed, which substantially constrains realistic exposure despite the critical impact.

This is a genuine high-severity memory-safety flaw but its real-world risk is gated by a local attack vector and a narrow affected configuration. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scoring 9.3 is internally consistent with the description: exploitation requires an already-running unprivileged task (PR:L, AV:L) rather than any network access, so this is NOT a remotely exploitable, internet-facing threat. Impact is severe where applicable - a numeric truncation (CWE-197) in the MPU buffer authorization check lets an unprivileged task read or write privileged kernel memory, which crosses the task/kernel privilege boundary and justifies the high confidentiality/integrity/availability and subsequent-system (SC:H/SI:H/SA:H) ratings. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis; this was reported by the vendor (AMZN/Amazon, which maintains FreeRTOS) and patched, indicating coordinated disclosure rather than observed in-the-wild abuse. Net: a real priority for anyone running the specific affected build (Cortex-R82 Armv8-R AArch64 MPU port on V11.3.0/V11.3.1), but low likelihood of opportunistic mass exploitation because an attacker must already have local unprivileged code execution on a device using a niche, recent hardware port.

An attacker who already has the ability to run an unprivileged task on an affected device (e.g. via a separate compromise or malicious application loaded onto an MPU-enabled FreeRTOS build on Arm Cortex-R82) invokes a stream buffer system call with a buffer length crafted to trigger the numeric truncation in the MPU authorization check. The truncated length passes validation, letting the task read or write privileged kernel memory beyond the validated window and escalate to kernel-level control. No public exploit code is identified at time of analysis, and exploitation requires local presence rather than remote access.