CVE-2026-113421 ThreadX Modules invokes trace-full callbacks after module unload

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-113421 ThreadX Modules invokes trace-full callbacks after module unload

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-102710

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TXENABLEEVENTTRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from privileged code when the trace buffer wraps. A...

CVE-2026-102710

Attacker model / Preconditions: a loaded "TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION" module issuing kernel dispatch calls, on a build with "TXENABLEEVENTTRACE". A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls ...

CVE-2026-102710

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TXENABLEEVENTTRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from privileged code when the trace buffer wraps. A...

EUVD-2026-89173

Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...

CVE-2026-102710

In Azure RTOS (Eclipse ThreadX) versions 6.0.1 through 6.5.2.202603 built with TX_ENABLE_EVENT_TRACE, a vulnerability exists where the Module Manager allows a user-mode, memory-protected module to register an arbitrary function pointer as the global trace-full callback . The kernel executes this ...

CVE-2026-102710

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TXENABLEEVENTTRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from privileged code when the trace buffer wraps. A...

CVE-2026-102710: Improper Privilege Management

Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...

PT-2026-102758

Name of the Vulnerable Software and Affected Versions Azure RTOS affected versions not specified Description In builds with TX ENABLE EVENT TRACE enabled, a user-mode, memory-protected module using TXM MODULE USER MODE | TXM MODULE MEMORY PROTECTION can register an arbitrary function pointer as t...