What’s Vulnerable › Vulnerabilities
CVE-2026-94023: Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
- Severity: medium (CVSS 6.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-20 · updated 2026-10-20
- Weakness: CWE-125
Description
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using an object a module does not own is supported and intended — `txm_module_object_pointer_get_extended` searches the system's created objects by name and hands back objects the application created and objects other modules created, so that a module can send to a shared queue, take a shared semaphore or get a shared mutex. Destroying one of those is not sharing it. A module could name any object it had a pointer to and have the privileged dispatcher delete it.
Affected products
- Eclipse Foundation Eclipse ThreadX: from 6.0.1 through 6.5.1.202602a
References
Get alerted when CVE-2026-94023 or the next vulnerability affects your stack