AWS FreeRTOS-Kernel V11.3.2 Fixes MPU Authorization Flaws
Tech GuruQuick Answer
AWS published 2026-138-AWS for two FreeRTOS-Kernel Arm Cortex-R82 MPU flaws affecting V11.3.0 and V11.3.1 when configENABLE_MPU=1. Inventory embedded builds and downstream forks, upgrade or backport V11.3.2, rebuild and deploy signed firmware, exercise privilege boundaries, monitor stability, and retain evidence.
Confirm Scope And Apply The Supported Fix
What to do now: Identify FreeRTOS-Kernel V11.3.0 and V11.3.1 Arm Cortex-R82 builds, confirm whether configENABLE_MPU=1, trace forks and shipped firmware, upgrade to or backport V11.3.2, rebuild and sign artifacts, stage device deployment with rollback, test MPU isolation and stream-buffer paths, and retain evidence.
Last verified: 2026-10-17 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | FreeRTOS-Kernel Arm Cortex-R82 MPU port |
|---|---|
| Advisory | 2026-138-AWS |
| CVEs | CVE-2026-109587, CVE-2026-109588 |
| Authoritative release date | 2026-10-16 17:00:00 UTC; AWS bulletin publication |
| Authority revision date | No separate revision date is stated by AWS; verified 2026-10-17 UTC |
| Affected versions | FreeRTOS-Kernel V11.3.0 and V11.3.1 Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use this MPU port and feature are not affected. |
| Fixed version | FreeRTOS-Kernel V11.3.2 or later, including equivalent fixes in any fork or derivative |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by AWS; no exploitation claim is inferred. |
What Changed
AWS fixed an authorization boundary error and a buffer-length truncation error in the Arm Cortex-R82 MPU port. Under affected configurations, an unprivileged task could read or write privileged kernel memory outside its assigned region. AWS does not provide a CVSS score or exploitation statement.
What To Validate Now
- Inventory. Locate FreeRTOS-Kernel Arm Cortex-R82 MPU port deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: FreeRTOS-Kernel V11.3.0 and V11.3.1 Arm Cortex-R82 builds with configENABLE_MPU=1; applications that do not use this MPU port and feature are not affected. Do not infer applicability from product family or severity alone.
- Remediate. Apply FreeRTOS-Kernel V11.3.2 or later, including equivalent fixes in any fork or derivative through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The affected scope is configuration- and architecture-specific. Do not mark a device remediated until the fixed kernel is incorporated into its actual firmware and deployed. Coordinate embedded regression, boot, watchdog, update-signing, and rollback testing; AWS does not state that exploitation has occurred.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
