CVE-2026-94192High· 8.5▾ TwilightA ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, inclu…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txm_module_object_deallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.
ThreadX >= 6.0.1 <= 6.5.1.202602aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94023Medium· 6.9Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
CVE-2026-95109High· 8.5Cortex-A7 module data validation checks only the first address of a caller-supplied range
CVE-2026-94024Medium· 6.9Module Manager object lookup validates one byte of a module's search name
CVE-2026-95108Medium· 6.8Deleting a user-mode module thread leaks its privileged kernel stack
CVE-2026-95107High· 7.0Module object allocation size overflow corrupts the manager object pool
CVE-2026-94202Medium· 4.8Module block-pool create validates two of the four parameter words it reads