Local privilege escalation via exposed MPU privilege paths

Privilege escalation in FreeRTOS 10.4.6 and earlier allows local users with injected code to gain kernel privilege. Non-kernel code can call xPortRaisePrivilege directly in 10.2.0 through 10.4.5, while a crafted stack frame can branch inside an MPU API wrapper through 10.4.6 because xRunningPrivileged remains on the local stack. The flaw is limited to ARMv7-M MPU ports and ARMv8-M ports with configENABLE_MPU set to 1, and exploitation requires prior injected-code execution.