CVE-2026-77237 Overview
CVE-2026-77237 is an out-of-bounds read vulnerability [CWE-125] in the FreeRTOS-Kernel affecting versions before 11.3.1. The flaw resides in the xQueueAddToSet() function, which fails to validate the queue-set type before operating on caller-supplied handles. On Memory Protection Unit (MPU) enabled ports built with configUSE_QUEUE_SETS=1, an unprivileged task can supply a crafted handle and cause the kernel to read privileged memory. This exposes sensitive kernel data to code that should be isolated by the MPU boundary. Amazon addressed the issue in FreeRTOS-Kernel release V11.3.1.
Critical Impact
An unprivileged task on an MPU-enabled FreeRTOS port can read privileged kernel memory, breaking the task isolation model the MPU is designed to enforce.
Affected Products
- Amazon FreeRTOS-Kernel versions prior to 11.3.1
- MPU-enabled FreeRTOS ports compiled with configUSE_QUEUE_SETS=1
- Embedded devices and firmware built against the vulnerable kernel
Discovery Timeline
- 2026-08-21 - CVE-2026-77237 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-77237
Vulnerability Analysis
FreeRTOS queue sets allow a task to block on multiple queues or semaphores using a single call. The xQueueAddToSet() API adds a queue or semaphore handle into a queue set container. On MPU-enabled ports, kernel APIs must validate that handles passed from unprivileged tasks reference legitimate kernel objects of the expected type.
The vulnerable code path in xQueueAddToSet() omits a queue-set type check before dereferencing the caller-supplied handle. An unprivileged task can pass a handle that points at arbitrary kernel-accessible memory. Because the function then reads structure fields at fixed offsets from that pointer, kernel data at attacker-chosen addresses can be inferred through the resulting behavior or state changes.
The issue is scoped to builds that enable queue sets and use MPU protection. Ports without MPU enforcement do not exhibit a privilege boundary to cross, and builds with configUSE_QUEUE_SETS=0 never compile the affected path.
Root Cause
The root cause is missing input validation on the object type behind a task-supplied handle. xQueueAddToSet() trusts that any handle passed from an unprivileged context is a valid queue-set object without verifying the underlying structure tag before dereferencing pointer fields.
Attack Vector
Exploitation requires local code execution as an unprivileged FreeRTOS task on an affected build. The attacker calls xQueueAddToSet() with a forged handle. The kernel dereferences the handle in privileged mode, reading memory the calling task cannot otherwise access. Successful abuse yields disclosure of privileged kernel memory without requiring elevated permissions on the device.
See the GitHub Security Advisory GHSA-9wvc-hqvx-5wf5 for the maintainer's technical description.
Detection Methods for CVE-2026-77237
Indicators of Compromise
- Firmware images or build manifests referencing FreeRTOS-Kernel versions earlier than V11.3.1 with configUSE_QUEUE_SETS=1 and an MPU port selected.
- Unprivileged tasks issuing calls to xQueueAddToSet() with handles not previously created via xQueueCreateSet().
- Anomalous task behavior following queue-set operations, including unexpected state reads or timing deviations consistent with kernel memory probing.
Detection Strategies
- Audit FreeRTOS build configurations across firmware repositories for the vulnerable combination of MPU support and queue sets.
- Review source code for unprivileged tasks that invoke xQueueAddToSet() with handles received from external sources or shared memory.
- Add static analysis rules that flag xQueueAddToSet() calls in MPU-restricted task contexts on kernels below 11.3.1.
Monitoring Recommendations
- Integrate firmware Software Bill of Materials (SBOM) data into a centralized log store to track FreeRTOS-Kernel versions in production fleets.
- Correlate device telemetry with firmware version inventories to prioritize patch deployment on devices running vulnerable builds.
- Alert on new firmware releases that regress FreeRTOS-Kernel below the fixed version.
How to Mitigate CVE-2026-77237
Immediate Actions Required
- Upgrade the FreeRTOS-Kernel to version V11.3.1 or later and rebuild all affected firmware images. See the FreeRTOS Kernel Release V11.3.1.
- Inventory all embedded products that ship MPU-enabled FreeRTOS builds with configUSE_QUEUE_SETS=1 and schedule field updates.
- Review the AWS Security Bulletin 2026-086 for vendor-specific guidance on managed FreeRTOS offerings.
Patch Information
Amazon fixed CVE-2026-77237 in FreeRTOS-Kernel V11.3.1 by adding the missing queue-set type validation in xQueueAddToSet(). Downstream vendors that fork the kernel must merge the upstream fix or apply the equivalent validation before dereferencing task-supplied handles.
Workarounds
- Disable queue sets by setting configUSE_QUEUE_SETS=0 in FreeRTOSConfig.h where the feature is not required, then rebuild the firmware.
- Restrict the ability of unprivileged tasks to call xQueueAddToSet() by wrapping the API in a privileged shim that validates handle provenance.
- Where MPU protection is optional, evaluate whether the deployment requires the isolation boundary that the vulnerability breaks and treat unpatched builds as trusted-code-only.
# Configuration example: disable queue sets in FreeRTOSConfig.h until patched
#define configUSE_QUEUE_SETS 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
