CVE-2026-102710 PUBLISHED

Assigner: eclipse
Reserved: 29.09.2026 Published: 29.09.2026 Updated: 29.09.2026

Attacker model / Preconditions: a loaded TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION module issuing kernel dispatch calls, on a build with TX_ENABLE_EVENT_TRACE.

A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps.

An invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (CONTROL.nPRIV = 0), confirmed at runtime with a register capture inside that code.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.3

Product Status

Vendor Eclipse Foundation
Product eclipse-threadx/threadx
Versions Default: unaffected
  • affected from 0 to v6.5.1.202602a_rel (incl.)

Credits

  • SounLabs reporter

References

Problem Types

  • CWE-269 Improper Privilege Management CWE
  • CWE-822 Untrusted Pointer Dereference CWE