CVE-2026-102710

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TXENABLEEVENTTRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from privileged code when the trace buffer wraps. A...

EUVD-2026-89173

Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...

CVE-2026-102710

Attacker model / Preconditions: a loaded "TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION" module issuing kernel dispatch calls, on a build with "TXENABLEEVENTTRACE". A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls ...

CVE-2026-102710

In Azure RTOS (Eclipse ThreadX) versions 6.0.1 through 6.5.2.202603 built with TX_ENABLE_EVENT_TRACE, a vulnerability exists where the Module Manager allows a user-mode, memory-protected module to register an arbitrary function pointer as the global trace-full callback . The kernel executes this ...

CVE-2026-102710

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TXENABLEEVENTTRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from privileged code when the trace buffer wraps. A...

CVE-2026-102710

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TXENABLEEVENTTRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from privileged code when the trace buffer wraps. A...