FreeRTOS MPU Authorization Bug on Cortex-R82 Fixes in V11.3.2 to Block Kernel Memory Access

An unprivileged task on an Arm Cortex-R82 processor running FreeRTOS-Kernel versions 11.3.0 or 11.3.1 can access privileged kernel memory outside its assigned regions. According to the National Vulnerability Database, this incorrect authorization flaw carries a CVSS score of 8.8, rated as high severity. The vulnerability exists specifically in the Memory Protection Unit port for the Arm Cortex-R82 architecture.

How it unfolded

• On October 16, 2026, AWS Security Bulletins published advisory 2026-138-AWS detailing two issues in the FreeRTOS-Kernel Arm Cortex-R82 MPU port.
• The bulletin identified CVE-2026-109587 as an incorrect authorization flaw where the port fails to enforce memory-region boundaries for unprivileged tasks passing buffer arguments.
• Amazon subsequently released FreeRTOS-Kernel version 11.3.2, which addresses the authorization issue and a related numeric truncation flaw, CVE-2026-109588.

Who is affected

The vulnerability impacts systems using the Arm Cortex-R82 processor with the FreeRTOS Memory Protection Unit enabled. According to the AWS advisory, applications that do not use the FreeRTOS MPU are not affected by either flaw. The issue specifically affects builds where the configuration flag configENABLE_MPU is set to 1. Organizations deploying microcontrollers or small microprocessors running these specific kernel versions on this architecture face exposure.

The fix

Amazon has released version 11.3.2 of the FreeRTOS-Kernel to remediate the authorization failure. The vendor recommends upgrading to this latest version. Additionally, teams using forked or derivative code should patch their builds to incorporate the new fixes. The advisory states there is no risk when the FreeRTOS MPU is not in use on the Arm Cortex-R82 port.

What made it possible

This vulnerability arises from a failure to enforce memory protection boundaries during system calls. When an unprivileged task passes a buffer argument, the kernel did not correctly validate the memory region limits. This allows the task to read or write data outside its assigned space. In intrusion scenarios, this weakness serves as a privilege escalation path. Attackers with access to a low-privilege task can bypass isolation controls. Teams usually check buffer validation logic in custom system calls. They should verify that memory protection units strictly enforce region boundaries.

What to do and how to stay safe: FreeRTOS

• Inventory all embedded devices running FreeRTOS-Kernel versions 11.3.0 or 11.3.1 on Arm Cortex-R82 processors.
• Verify if the FreeRTOS Memory Protection Unit is enabled in your build configurations before assessing exposure levels.
• Upgrade to FreeRTOS-Kernel version 11.3.2 or later to apply the vendor-provided fix for the authorization flaw.
• Monitor system logs for unexpected memory access patterns from unprivileged tasks that may indicate exploitation attempts.

Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability affect FreeRTOS builds that do not use the Memory Protection Unit?

No, applications that do not use the FreeRTOS MPU are not affected by this issue, according to the AWS advisory.

What is the severity rating for CVE-2026-109587?

The National Vulnerability Database rates the flaw as high severity with a CVSS score of 8.8.

Who discovered and reported this vulnerability?

Ada Logics Ltd and Anthropic collaborated on the issue through the coordinated vulnerability disclosure process.