AIKIDO-2026-156512

TL;DR

FreeRTOS-Kernel validates software timer commands incompletely on MPU-enabled ports. An unprivileged task can submit a crafted timer command that reaches a privileged code path intended to be invoked only internally by the kernel. This lets the unprivileged task make the privileged timer service task execute an arbitrary function, running code in the privileged kernel context and bypassing MPU task isolation. The fix adds range and privilege validation to the timer command handling path.