Skip to main content

Issue with FreeRTOS-Kernel - CVE-2026-77234, CVE-2026-77235, CVE-2026-77236, CVE-2026-77237

Bulletin ID: 2026-086-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/21/2026 10:30 AM PDT

Description:

FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors. AWS identified four issues with FreeRTOS-Kernel, affecting multiple versions.

  • CVE-2026-77234:
    incomplete command validation in the software timer command path allows an unprivileged task to reach a privileged code path that is intended to be invoked only internally, resulting in arbitrary code execution in a privileged kernel context and bypassing MPU-enforced task isolation. This issue affects configurations that use the FreeRTOS MPU together with software timers; applications that do not use the FreeRTOS MPU are not affected.

  • CVE-2026-77235:
    missing privilege validation in the ARM TrustZone (ARMv8-M) secure-context handling allows an unprivileged Non-Secure task to free a task's secure context while it is still in use, resulting in a use-after-free of Secure-world memory and Secure-context corruption that typically causes a crash or undefined behavior. This issue affects ARM TrustZone (ARMv8-M) configurations; applications that do not use ARM TrustZone secure contexts are not affected.

  • CVE-2026-77236:
    missing size validation in the ARM TrustZone (ARMv8-M) secure-context allocation allows a Non-Secure task requesting a secure context with an undersized stack to trigger an out-of-bounds write into Secure-world memory, corrupting adjacent Secure-heap control structures and typically causing a crash or undefined behavior. This issue affects ARM TrustZone (ARMv8-M) configurations; applications that do not use ARM TrustZone secure contexts are not affected.

  • CVE-2026-77237:
    missing type validation in the queue-set feature allows a non-conforming handle to be added to a queue set, causing a later queue-set operation to perform an out-of-bounds read in privileged kernel context and place the over-read bytes into application-readable storage. This discloses the contents of privileged kernel memory and can facilitate further attacks. This issue affects builds with queue sets enabled; applications built without queue sets are not affected.

Impacted versions:

  • CVE-2026-77234: >=7.0.0 AND <=11.3.0 (MPU-enabled ports)
  • CVE-2026-77235: >=10.2.0 AND <=11.3.0 (ARMv8-M ports with TrustZone + MPU)
  • CVE-2026-77236: >=10.2.0 AND <=11.3.0 (ARMv8-M ports with TrustZone)
  • CVE-2026-77237: >=7.4.0 AND <=11.3.0 (MPU-enabled ports with configUSE_QUEUE_SETS=1)

Resolution:

This issue has been addressed in FreeRTOS-Kernel version V11.3.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

  • CVE-2026-77234:
    There is no risk when not using software timers. If using software timers, upgrading to the fixed version is the recommended remediation.
  • CVE-2026-77235 and CVE-2026-77236:
    There is no complete workaround short of upgrading; applications that do not use ARM TrustZone secure contexts are not exposed. Upgrading to the fixed version is the recommended remediation.
  • CVE-2026-77237:
    There is no risk when not using queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.

References:

Acknowledgement:

We would like to thank NVIDIA (Project Vanessa) for collaborating on this issue through the coordinated vulnerability disclosure process


Please email aws-security@amazon.com with any security questions or concerns.