{"id":"CVE-2026-94023","kind":"vulnerability","aliases":["CVE-2026-94023"],"related":[],"title":"ThreadX: Module Manager lets a module delete kernel objects it does not own","description":"A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using an object a module does not own is supported and intended — `txm_module_object_pointer_get_extended` searches the system's created objects by name and hands back objects the application created and objects other modules created, so that a module can send to a shared queue, take a shared semaphore or get a shared mutex.\n\n\n\nDestroying one of those is not sharing it. A module could name any object it had a pointer to and have the privileged dispatcher delete it.","summary":"ThreadX's Module Manager checks only whether an object lies outside a module's own memory before dispatching a delete call, so a module can destroy shared kernel objects such as queues, semaphores and mutexes that other modules or the application created. The sources do not describe a code-execution path, so the worst case is disruption of shared objects that other code depends on.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","module-manager","rtos","runtime","threadx"],"not_affected_if":["no-module-manager","single-trusted-module"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:40:25+00:00","updated_at":"2026-10-25T03:40:25+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:40:25Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"ThreadX: Module Manager lets a module delete kernel objects it does not own","impact":"medium","summary":"ThreadX's Module Manager checks only whether an object lies outside a module's own memory before dispatching a delete call, so a module can destroy shared kernel objects such as queues, semaphores and mutexes that other modules or the application created. The sources do not describe a code-execution path, so the worst case is disruption of shared objects that other code depends on.","category":"runtime","nicknames":[],"who_cares":["threadx","embedded","rtos","module-manager"],"confidence":0.6,"needs_auth":"unknown","worst_case":"A loaded module deletes shared queues, semaphores or mutexes used by other code","analyst_note":"Find the affected ThreadX versions and the fixed release in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-94023) or the Eclipse ThreadX advisory it cites.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-module-manager","single-trusted-module"],"who_is_affected":"Systems built on ThreadX that load dynamic modules through the Module Manager, where more than one module or the application shares kernel objects by name. Systems without the Module Manager, or that load only trusted modules, are less exposed. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000601,"input_tokens":3423,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-94023':12A,15A 'applic':63B,164C 'ask':106C 'back':161C 'call':43B 'case':78B 'check':27B 'code':72B,86B,121C 'code-execut':71B 'could':200C 'creat':64B,155C,165C,170C 'cve':10A,13A 'data':123C 'delet':7A,42B,96C,214C 'depend':87B 'describ':69B 'destroy':48B,190C 'dispatch':40B,103C,213C 'disrupt':80B 'embed':16B 'execut':73B 'extend':150C 'get':149C,186C 'hand':160C 'intend':144C 'kernel':8A,50B,93C 'layer':104C 'let':4A 'lie':32B,115C 'manag':3A,19B,26B,101C 'memori':38B 'modul':2A,6A,18B,25B,35B,46B,60B,90C,100C,118C,137C,146C,169C,174C,199C 'module-manag':17B 'mutex':57B,189C 'name':158C,201C 'object':9A,31B,51B,83B,94C,114C,131C,135C,147C,156C,162C,167C,203C 'one':107C,191C 'outsid':33B,116C 'path':74B 'pointer':111C,148C,207C 'polici':127C 'privileg':212C 'question':108C 'queue':54B,180C 'reach':91C 'rtos':20B 'runtim':21B 'search':151C 'semaphor':55B,184C 'send':176C 'servic':97C 'share':49B,82B,179C,183C,188C,196C 'sourc':66B 'support':142C 'system':153C 'take':181C 'threadx':1A,22B,23B,89C 'txm':145C 'use':129C,133C 'whether':29B 'worst':77B","nicknames":[],"mitigations":[],"who_affected":"Systems built on ThreadX that load dynamic modules through the Module Manager, where more than one module or the application shares kernel objects by name. Systems without the Module Manager, or that load only trusted modules, are less exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94023","severity":null,"published_at":"2026-10-20T16:17:17+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}