Key points
- CVE-2026-109587 affects FreeRTOS-Kernel versions 11.3.0 and 11.3.1.
- The flaw has a CVSS score of 8.8, rated as HIGH severity.
- A patch is available in FreeRTOS-Kernel version 11.3.2 and later.
Security operations teams must address CVE-2026-109587 in FreeRTOS-Kernel deployments. The flaw exists in versions 11.3.0 and 11.3.1 of the real-time operating system kernel. It involves incorrect authorization in the Arm Cortex-R82 memory protection unit port. An unprivileged task can exploit this to access privileged kernel memory. This occurs when a buffer argument is passed to an MPU system call.
In plain English
The issue stems from a failure in how the kernel manages memory permissions. Normally, an unprivileged task should only access memory regions specifically assigned to it. However, this authorization error allows such tasks to bypass those boundaries. They can both read from and write to privileged kernel memory areas. This happens through a specific interaction with the memory protection unit system call.
The background
The vulnerability is tracked as CVE-2026-109587 in the National Vulnerability Database. It carries a CVSS score of 8.8, which falls into the HIGH severity category. The weakness is classified under CWE-863. This flaw impacts FreeRTOS-Kernel builds that are configured with memory protection unit support. It affects the specific Arm Cortex-R82 implementation within the kernel.
What changes now
A remediation path is available for affected systems. Users should upgrade their FreeRTOS-Kernel installations to version 11.3.2 or any later release. This update addresses the incorrect authorization logic in the MPU port. The fix applies to all builds up through version 11.3.1. Teams should verify their current kernel version before planning the update process.
Who needs to act first
Teams usually prioritize systems exposed to external threats or handling sensitive data. Check whether your embedded devices run the affected FreeRTOS versions. If so, plan a controlled rollout of the patch. Test the update in a non-production environment first to ensure stability. Back up current configurations before applying changes. Monitor logs for any unusual memory access patterns during the transition period.
What to do and how to stay safe: FreeRTOS
- Inventory all systems running FreeRTOS-Kernel versions 11.3.0 and 11.3.1.
- Verify if these systems are configured with MPU-enabled builds.
- Schedule an upgrade to FreeRTOS-Kernel version 11.3.2 or later.
- Monitor system logs for unauthorized memory access attempts post-patch.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which FreeRTOS versions are affected by CVE-2026-109587?
Versions 11.3.0 and 11.3.1 of the FreeRTOS-Kernel are affected.
Is there a fix for this vulnerability?
Yes, users should upgrade to version 11.3.2 or later.
What is the severity of this flaw?
It has a CVSS score of 8.8, rated as HIGH.
