Live › vulnerability › CVE-2026-94202
Go to dashboardThe Module Manager's block-pool create dispatcher reads two words of a memory-protected module's extra-parameter array without proving the module owns them. An attacker who controls a module can read memory outside that module's data during the pool create validation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that build and run ThreadX with the Module Manager and memory-protected modules. The sources do not say which versions are affected or which configurations enable the module manager, so unknown whether a default build is exposed. Teams not using the ThreadX Module Manager can skip it.
No product ranges from the sources yet.
common_modules/module_manager/inc/txm_module_manager_dispatch.h and the function _txm_module_manager_tx_block_pool_create_dispatch in your ThreadX source treeUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Module Manager's block-pool create dispatcher proved that two ALIGN_TYPE words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array.
One of the two unproved words is read by the dispatcher's own buffer check, which takes index 1 as the pool start and index 2 as the length to range-check it over. So the out-of-bounds read is performed by the validation code itself, before the kernel service is reached, and the size the caller's pool start is then validated against is a word the manager has not proved the module owns. The other unproved word is read when the service's argument list is built.
Vulnerable function: _txm_module_manager_tx_block_pool_create_dispatch, in common_modules/module_manager/inc/txm_module_manager_dispatch.h.
This page as .md · .json · in your agent: get_signal("CVE-2026-94202")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.