SB20261109152 - Multiple vulnerabilities in FreeRTOS

Description

This security bulletin contains information about 2 vulnerabilities.

1) Numeric Truncation Error (CVE-ID: CVE-2026-109588)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker with low privileges to bypass MPU-enforced task isolation and escalate privileges in FreeRTOS-Kernel.

The vulnerability exists due to buffer-length truncation in the Arm Cortex-R82 MPU authorization check when an unprivileged task invokes a stream buffer system call with configENABLE_MPU=1. A local attacker with low privileges can supply a buffer extending beyond the validated window to read or write privileged kernel memory.

2) Incorrect authorization (CVE-ID: CVE-2026-109587)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged local attacker to read and write privileged kernel memory and escalate privileges.

The vulnerability exists due to incorrect memory-region boundary enforcement in the FreeRTOS-Kernel Arm Cortex-R82 MPU port when an unprivileged task passes a buffer argument to an MPU system call. A low-privileged local attacker can run such a task on a build with configENABLE_MPU=1 to access memory outside its assigned regions and bypass task isolation.

Remediation

Install update from vendor's website.

References

• https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-qf4j-6f5j-876g
• https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-pv9j-rq42-3fjc