ROS-20260930-73-0087

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0093

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0092

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0080

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102730

LevelX's NAND flash-translation-layer metadata parser contains an unbounded out-of-bounds heap write triggered by mounting an attacker-controlled NAND flash image via lx_nand_flash_open(). The root cause is an unchecked on-flash count in a parser partially generated by an AI. This vulnerability a...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

EUVD-2026-89201

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

EUVD-2026-89174

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102711

The ThreadX loadable-module loader contains two issues triggered when a device loads an attacker-controlled module via the _txm_module_manager_memory_load or _txm_module_manager_in_place_load APIs. Because these APIs accept only a base pointer without an image length, fields in TXM_MODULE_PREAMBL...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

PT-2026-102759

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txm module manager memory load / txm module manager in place load — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXM MODULE PREAMBLE is full...

ROS-20260929-73-0105

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-102730: Out-of-bounds Write

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102711: Out-of-bounds Read

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

ROS-20260929-73-0107

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-102796

Mounting an attacker-controlled NAND flash image lx nand flash open triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

ROS-20260929-73-0029

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...