Live › vulnerability › CVE-2026-94024
Go to dashboardThe ThreadX Module Manager's object lookup checks only one byte of a module's search name and then reads as many bytes as the module declares, in privileged mode. A module can make the read run past its buffer into memory the kernel cannot safely read, and the resulting fault can leave the kernel unable to preempt for the rest of the system's life.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the ThreadX Module Manager with loadable modules, where a module can be loaded and call the object lookup dispatchers or the deprecated . Systems that do not use the Module Manager or do not load untrusted modules are less exposed; the sources do not say which versions are affected.
txm_module_object_pointer_get_extendedtxm_module_object_pointer_getNo product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended txm_module_object_pointer_get_extended is handed a length and does not use it to bound the buffer, and the deprecated txm_module_object_pointer_get supplies the largest value a UINT can hold, so it removes the bound rather than lacking one.
A module can make the walk unbounded without knowing anything about the memory it reaches, and where the walk reaches memory a privileged read cannot take, the resulting fault leaves the kernel unable to preempt for the rest of the system's life.
Vulnerable functions: _txm_module_manager_txm_module_object_pointer_get_dispatch, _txm_module_manager_txm_module_object_pointer_get_extended_dispatch (both in common_modules/module_manager/inc/txm_module_manager_dispatch.h) and _txm_module_manager_object_name_compare (common_modules/module_manager/src/txm_module_manager_util.c).
This page as .md · .json · in your agent: get_signal("CVE-2026-94024")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.