AWS’s security bulletin AV-2026-138 identifies two issues in the FreeRTOS-Kernel Arm Cortex-R82 MPU port, specifically for builds with configENABLE_MPU=1. It names CVE-2026-109587 and CVE-2026-109588, and notes that non-MPU deployments are not affected.
- CVE-2026-109587: Incorrect authorization in the Arm Cortex-R82 MPU port; unprivileged task could read/write privileged memory.
- CVE-2026-109588: Numeric truncation in the MPU buffer authorization check; buffer-length validation may permit access beyond the validated window.
WHAT IS AFFECTED—AND WHAT IS NOT
The issues affect Arm Cortex-R82 builds with configENABLE_MPU=1. Applications that do not use the FreeRTOS MPU are not affected.
REMEDIATION PATH AND HOW TO APPLY IT
The bulletin states the issue has been addressed in FreeRTOS-Kernel version V11.3.2. Upgrading to V11.3.2 or applying patched derivatives is recommended. If the FreeRTOS MPU is not used, no action is required.
HOW TO VERIFY AND PROCEED IN YOUR ENVIRONMENT
Check whether your FreeRTOS-Kernel deployment uses the Arm Cortex-R82 MPU port with configENABLE_MPU=1. If MPU is enabled, upgrade to V11.3.2 or patched derivatives; if MPU is not enabled, this advisory does not apply.
RELATED COVERAGE
- CVE-2026-110812 in Amazon Neptune: what operators should know and how to respond
- Post-quantum authentication: Why organizations should start testing certificate ecosystems now
- CISOs weigh vulnerability risk management in the AI era
- Storm-3168: Agentic-driven cloud attacks hinge on compromised service principals, Microsoft Security Blog reports
- Security articles
SOURCES
- Latest Bulletins: CVE-2026-109587 & CVE-2026-109588 - Issue with FreeRTOS-Kernel Published · Primary source
