CVE-2026-94023: fallo de gravedad media en Eclipse ThreadX
Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.1%
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using an object a module does not own is supported and intended — `txm_module_object_pointer_get_extended` searches the system's created objects by name and hands back objects the application created and objects other modules created, so that a module can send to a shared queue, take a shared semaphore or get a shared mutex.
Destroying one of those is not sharing it. A module could name any object it had a pointer to and have the privileged dispatcher delete it.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Eclipse Foundation · Eclipse ThreadXCVEs relacionadas — Eclipse ThreadX
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-115215HIGHNetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session poolEPSS 0.4%CVE-2026-115403HIGHNULL pointer dereference in the BSD raw IPv6 send path when the destination table is fullEPSS 0.3%CVE-2026-95108MEDIUMDeleting a user-mode module thread leaks its privileged kernel stackEPSS 0.2%CVE-2026-95107HIGHModule object allocation size overflow corrupts the manager object poolEPSS 0.2%CVE-2026-94202MEDIUMModule block-pool create validates two of the four parameter words it readsEPSS 0.2%CVE-2026-95109HIGHCortex-A7 module data validation checks only the first address of a caller-supplied rangeEPSS 0.1%