CVE-2026-94192: falha de alta gravidade em Eclipse ThreadX
Module object deallocation can free a live ThreadX kernel object
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.1%
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Eclipse Foundation · Eclipse ThreadXCVEs relacionadas — Eclipse ThreadX
No mesmo produto, das mais perigosas para as menos.
CVE-2026-115215HIGHNetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session poolEPSS 0.4%CVE-2026-115403HIGHNULL pointer dereference in the BSD raw IPv6 send path when the destination table is fullEPSS 0.3%CVE-2026-95108MEDIUMDeleting a user-mode module thread leaks its privileged kernel stackEPSS 0.2%CVE-2026-95107HIGHModule object allocation size overflow corrupts the manager object poolEPSS 0.2%CVE-2026-94202MEDIUMModule block-pool create validates two of the four parameter words it readsEPSS 0.2%CVE-2026-95109HIGHCortex-A7 module data validation checks only the first address of a caller-supplied rangeEPSS 0.1%