FreeRTOS-Kernel CVE-2026-119086

Exploitation requires all of the following concrete conditions, each confirmed by the GHSA advisory and description: (1) an MPU-enabled FreeRTOS-Kernel port (the MPU wrappers must be in use), (2) queue sets compiled in via configUSE_QUEUE_SETS=1, and (3) an affected kernel version (>=V7.4.0 through <=V11.3.2). The attacker must also already be executing as a local unprivileged task on the device (PR:L, AV:L) and invoke the queue-set selection system call against a non-queue-set object. Limiting factors that reduce real-world exposure: no remote/network vector exists, a pre-existing unprivileged code-execution foothold is required, and firmware built without queue sets is entirely unaffected - the vendor notes this non-default build configuration dependency explicitly.

This is a credible, well-substantiated integrity vulnerability rather than an inflated high score. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the description agree: exploitation requires a local, already-running unprivileged FreeRTOS task - there is no remote or network path - but no user interaction and no special timing (AT:N) is needed once that foothold exists. The impact is a privileged-memory integrity breach (VI:H/SI:H) with no confidentiality (VC:N) or availability (VA:N) effect, consistent with a type-confusion (CWE-843) write primitive that overflows a pointer-sized object on the privileged kernel stack (CWE-121) and crosses the FreeRTOS MPU task-isolation boundary. No EPSS score, KEV listing, or PoC was supplied; absence of these is not evidence of safety but means there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_week', which aligns with the signals: a confirmed, vendor-patched flaw that defeats a core security boundary (MPU isolation) but is gated behind local code execution and a non-default build configuration, so it warrants prompt patching rather than emergency response. The attack vector and exploitation conditions are internally consistent - no contradictory signals were found.

On a microcontroller firmware image built with an MPU-enabled FreeRTOS port and configUSE_QUEUE_SETS=1, an attacker who already controls an unprivileged task (for example via a separate RCE or a malicious/compromised application task) invokes the queue-set selection system call referencing an object that is not actually a queue set. Missing type validation causes the kernel, while running privileged, to write attacker-controlled data beyond a pointer-sized object on the privileged stack, corrupting privileged memory and breaking MPU task isolation. No public exploit code was identified at time of analysis; the issue was found via coordinated disclosure by Anthropic (Claude) and Ada Logics.