Advisories

CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel

Bulletin ID: 2026-138-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/16/2026 10:00 AM PDT Description: FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. AWS identified two issues with the FreeRTOS-Kernel Arm Cortex-R82 (Armv8-R AArch64) MPU port, affecting multiple versions. CVE-2026-109587: incorrect authorization in the Arm Cortex-R82 MPU port. On MPU-enabled builds, the port does not correctly enforce the memory-region boundaries assigned to an unprivileged task when it passes a buffer argument to an MPU system call. Under certain conditions, an unprivileged task might read and wr

Read at AWS Security Bulletins

Vendor

Amazon Web Services

• AWS Security Bulletins (aws.amazon.com)
• CVE-2026-109587 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-109588 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 15
   CVE NVD 15d ago

   Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R…

   CVSS 8.8 Fix available CVE-2026-109588 Google
2. 15
   CVE NVD 15d ago

   Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on…

   CVSS 8.8 Fix available CVE-2026-109587 Google