FreeRTOS-Kernel Flaws Allow Privilege Escalation and Memory Corruption

AWS released security bulletin 2026-086-AWS on August 21, 2026, detailing four vulnerabilities in the FreeRTOS-Kernel. The real-time operating system kernel is widely used in microcontrollers and small microprocessors. These flaws impact multiple versions through 11.3.0 and require specific hardware or software configurations to be exploitable.

Root cause

The issues stem from incomplete or missing validation checks in specific kernel paths. CVE-2026-77234 involves incomplete command validation in the software timer command path. This allows an unprivileged task to reach privileged code intended for internal use only. CVE-2026-77235 and CVE-2026-77236 relate to ARM TrustZone secure-context handling. One lacks privilege validation, while the other misses size validation for stack requests. CVE-2026-77237 involves missing type validation in the queue-set feature.

Attack path

CVE-2026-77234 enables arbitrary code execution in a privileged kernel context, bypassing MPU-enforced task isolation. An attacker needs an unprivileged task and software timers enabled. CVE-2026-77235 allows an unprivileged Non-Secure task to free a secure context while in use, causing a use-after-free condition. This typically results in a crash or undefined behavior. CVE-2026-77236 permits an out-of-bounds write into Secure-world memory via an undersized stack request. CVE-2026-77237 allows an out-of-bounds read in privileged kernel context, disclosing kernel memory contents.

Affected versions

• CVE-2026-77234 affects versions >=7.0.0 and <=11.3.0 on MPU-enabled ports using software timers.
• CVE-2026-77235 affects versions >=10.2.0 and <=11.3.0 on ARMv8-M ports with TrustZone and MPU.
• CVE-2026-77236 affects versions >=10.2.0 and <=11.3.0 on ARMv8-M ports with TrustZone.
• CVE-2026-77237 affects versions >=7.4.0 and <=11.3.0 on MPU-enabled ports with configUSE_QUEUE_SETS=1.

Mitigation

• Upgrade to FreeRTOS-Kernel version 11.3.1, which addresses all four issues.
• Ensure any forked or derivative code is patched to incorporate the new fixes.
• Disable software timers if they are not required to mitigate CVE-2026-77234.
• Disable queue sets if they are not required to mitigate CVE-2026-77237.

Signals worth monitoring

Teams should watch for unexpected crashes or undefined behavior in devices using ARM TrustZone secure contexts. Monitor logs for privilege escalation attempts from unprivileged tasks accessing internal kernel functions. Look for memory corruption indicators, such as out-of-bounds reads or writes in secure-world memory. Check for anomalous access patterns to queue sets or software timers. Investigate any sudden changes in kernel memory visibility or task isolation failures.

What to do and how to stay safe: FreeRTOS-Kernel

• Audit your FreeRTOS-Kernel versions to identify if they fall within the affected ranges.
• Review your build configurations to see if MPU, TrustZone, or queue sets are enabled.
• Plan an upgrade to version 11.3.1 or later to apply the vendor-provided fixes.
• Monitor device logs for crashes or memory errors that could indicate exploitation attempts.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific configurations are affected by CVE-2026-77234?

CVE-2026-77234 affects configurations that use the FreeRTOS MPU together with software timers.

Is there a workaround for CVE-2026-77235 and CVE-2026-77236?

There is no complete workaround short of upgrading to the fixed version.

Who discovered these vulnerabilities?

NVIDIA (Project Vanessa) collaborated on this issue through the coordinated vulnerability disclosure process.