CVE-2026-94192 PUBLISHED

Module object deallocation can free a live ThreadX kernel object

Assigner: eclipse
Reserved: 23.09.2026 Published: 20.10.2026 Updated: 20.10.2026

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txm_module_object_deallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.5

Product Status

Vendor Eclipse Foundation
Product Eclipse ThreadX
Versions Default: unaffected
  • affected from 6.0.1 to 6.5.1.202602a (incl.)
  • Version 6.5.2.202603 is unaffected

Credits

  • fdesbiens finder

References

Problem Types

  • CWE-416 Use After Free CWE
  • CWE-664 Improper Control of a Resource Through its Lifetime CWE