CVE-2026-77235 exposes a design-level failure in FreeRTOS-Kernel's TrustZone boundary enforcement: the SVC handler for secure context deallocation trusts its caller implicitly rather than verifying privilege at the boundary. In ARM TrustZone, the SVC instruction is the controlled seam between non-secure and secure worlds — it's where privilege transitions are supposed to happen. This handler skips that check entirely. The deallocation function assumes it's called by already-privileged secure-side code; the handler assumes it's reached only through correct call paths. That chain of assumptions was never verified, making privilege escalation a matter of exploiting a service call that should never have been reachable from non-secure context at all.
The use-after-free in secure-world memory is the symptom, not the disease. The root cause is architectural: non-secure world code was handed an uncontrolled handle to secure-side memory management. Whether this is exploitable depends on the secure partition's heap allocator — specifically, whether freed secure contexts can be reallocated and whether a subsequent secure-world operation will dereference the dangling pointer. If the allocator prevents reallocation or the dangling reference is never reached before a secure context switch, the practical risk drops significantly.
For defenders, three questions determine your exposure. First: what is the actual attack surface — can arbitrary non-secure tasks trigger this, or only those with specific peripheral access? Second: does any existing check (even informal) exist between SVC dispatch and the deallocation function, or is this a completely open gate? Third: does the 11.3.1 fix add the missing check at the handler entry point, or does it restructure the deallocation pathway entirely? The fix location answers whether this was an oversight or a fundamental misunderstanding of the privilege model.
The CVSS 7.3 score warrants scrutiny. It may underweight scenarios where a non-secure thread can deterministically corrupt specific secure-world state through timed deallocation requests. But it may overstate risk if your secure allocator prevents the reallocation path entirely.
This pattern has lineage. Similar missing NS/S privilege verification at the SVC seam appeared in OP-TEE circa 2019 and Trusted Firmware-A before the 2.x series. The recurrence isn't coincidental — ARM documentation describes what the hardware provides, not what software must enforce at every call site. The gap between "hardware provides isolation" and "software must verify it" gets rediscovered by every new embedded team implementing TrustZone.
The upstream fix in 11.3.1 is likely a single-line privilege check. Deploying it is another matter. FreeRTOS-Kernel ships inside vendor BSPs with kernel upgrade cycles measured in months. Hardware deployed today on 11.2.x will remain in production deployment well beyond this disclosure with no clear upgrade path. Your remediation window may be determined more by vendor support contracts than by upstream patch availability.