FreeRTOS-Kernel queue-set validation flaw listed as EUVD-2026-114246
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- FreeRTOS
- Product
- FreeRTOS-Kernel
- First seen
Summary
The EUVD listing (CVSS v3.1 score 8.2) describes missing queue-set type validation in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled, which lets a local unprivileged task write actor-controlled data beyond a pointer-sized object. The listing does not name a CVE ID in the visible text.
If you use FreeRTOS
Check whether your embedded projects use FreeRTOS-Kernel earlier than V11.3.3 on MPU-enabled ports
Update FreeRTOS-Kernel to V11.3.3 or later
Restrict untrusted code from running as local tasks on affected devices until patched
What the sources say 1
· Mastodon: “Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object o...” Source