AIKIDO-2026-39596

TL;DR

The queue-set feature does not validate the type of handles added through xQueueAddToSet. A non-conforming handle can be inserted and later accessed as an incompatible type, triggering an out-of-bounds read inside privileged kernel space. This can disclose sensitive kernel memory contents to unprivileged application code. The fix validates the handle type before it is added to a queue set.