7.3
High
CVE-2026-113421 In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full…
Description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse ThreadX 6.0 | 6.0.1 → 6.5.2.202603 | No fix stated |
References
- github.com github.com
- gitlab.eclipse.org gitlab.eclipse.org
Timeline
- Published
- Last modified
Other CVEs of Eclipse ThreadX
The 20 CVEs of Eclipse ThreadX →
CVE-2026-115231
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module…
8.5
High
CVE-2026-115215
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its…
8.7
High
CVE-2026-115403
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw…
8.2
High
CVE-2026-115654
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a…
6.9
Medium