Key points
- FreeRTOS Kernel versions 11.3.0 and 11.3.1 contain a numeric truncation flaw in MPU buffer checks.
- The issue affects Arm Cortex-R82 processors running AArch64 architecture with memory protection enabled.
- Vendors recommend upgrading to version 11.3.2 or later to remediate the security risk.
FreeRTOS users running kernel versions 11.3.0 and 11.3.1 must update their systems immediately. The National Vulnerability Database rates this flaw as high severity with a CVSS score of 8.8. The vulnerability exists specifically on the Arm Cortex-R82 processor port using the AArch64 architecture. It allows unprivileged tasks to bypass memory protection boundaries under certain conditions.
In plain English
The bug involves a calculation error when checking buffer sizes. The system truncates the numeric value of the buffer length during authorization. This mistake lets software tasks read or write memory areas they should not touch. Specifically, unprivileged code can access privileged kernel memory. The attack vector uses a stream buffer system call. The flaw is tied to weaknesses in numeric handling and buffer management.
The background
The issue is tracked as CVE-2026-109588. It relates to Common Weakness Enumerations 197, 787, and 125. These categories cover numeric errors and out-of-bounds memory access. The vulnerability is present in FreeRTOS-Kernel builds that enable the Memory Protection Unit. It does not affect all FreeRTOS deployments, only those on the specific Arm Cortex-R82 hardware.
What changes now
A fix is available for this vulnerability. Users should upgrade to FreeRTOS-Kernel version 11.3.2 or any later release. The vendor has confirmed that these newer versions resolve the buffer length truncation issue. Systems running older kernels remain exposed until the update is applied. No other mitigation steps are confirmed by the vendor at this time.
Who needs to act first
Teams should prioritize updating systems that are exposed to untrusted code or external inputs. Check whether your deployment uses the Arm Cortex-R82 processor with memory protection enabled. Verify the current kernel version against the affected list. Roll out the update to test environments first to ensure stability. Back up configurations before applying the change. Monitor system logs for unusual memory access patterns during the transition period.
What to do and how to stay safe: FreeRTOS
- Audit all embedded systems to identify those running FreeRTOS kernel versions 11.3.0 or 11.3.1.
- Confirm if the hardware uses the Arm Cortex-R82 processor with AArch64 architecture.
- Schedule an upgrade to version 11.3.2 or later as soon as possible.
- Monitor system behavior for signs of unauthorized memory access during the update process.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which FreeRTOS versions are affected by CVE-2026-109588?
FreeRTOS-Kernel versions 11.3.0 and 11.3.1 are affected by this vulnerability.
Is there a fix available for this memory access flaw?
Yes, users should upgrade to version 11.3.2 or later to remediate the issue.
What hardware is impacted by this specific vulnerability?
The flaw affects systems using the Arm Cortex-R82 processor with AArch64 architecture.
