CVE-2026-119086

Name of the Vulnerable Software and Affected Versions FreeRTOS-Kernel versions prior to 11.3.3

Description On MPU-enabled ports with queue sets enabled, the queue-set selection system call lacks proper type validation. This allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, which impacts privileged memory across the MPU (Memory Protection Unit) isolation boundary.

Recommendations Upgrade to FreeRTOS-Kernel version 11.3.3, rebuild, and reflash the affected firmware. Disable queue sets in the build configuration to mitigate the risk.