Bulletin ID: 2026-158-AWS
Publication Date: 10/30/2026 10:30 AM PDT
Description:
FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.
Impacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)
Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Read the original article:
CVE-2026-119086 – Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel