CVE-2026-102710

Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...

CVE-2026-102710

In builds with TX_ENABLE_EVENT_TRACE , a user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls this pointer directly from privileged kernel code without validation or a trampoline when the trace buffer wraps. This allows ...

EUVD-2026-89173

Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...