{"id":"CVE-2026-95108","kind":"vulnerability","aliases":["CVE-2026-95108"],"related":[],"title":"ThreadX: deleting a user-mode thread leaks its kernel stack, exhausting the pool","description":"One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_create` then takes a second allocation of `TXM_MODULE_KERNEL_STACK_SIZE` bytes for the privileged kernel stack that thread's system calls run on, and records it in the control block. Both come from `_txm_module_manager_object_pool` and both are linked onto the module's allocation list.\n\n\n\nThe Module Manager's thread-delete dispatcher released only the first. The kernel stack stayed allocated until the whole module was stopped, so a module that creates, terminates and deletes threads in a loop — every state transition valid, every service returning `TX_SUCCESS` — removed a fixed block from a finite pool shared by the manager and by every other loaded module, on every cycle, for as long as it stayed loaded. Once the pool is exhausted, no memory-protected module can create any kernel object and no user-mode module thread can be created anywhere in the system.\n\n\n\nVulnerable function: `_txm_module_manager_tx_thread_delete_dispatch`, in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`.","summary":"In the ThreadX Module Manager, deleting a user-mode thread frees only its control block and not the privileged kernel stack allocated with it. A module that repeatedly creates and deletes threads drains a finite shared object pool, so later module thread or object creation fails for the whole system (denial of service).","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","rtos","runtime","threadx"],"not_affected_if":["no-user-mode-modules"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:44:39+00:00","updated_at":"2026-10-25T03:44:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:44:39Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"ThreadX: deleting a user-mode thread leaks its kernel stack, exhausting the pool","impact":"low","summary":"In the ThreadX Module Manager, deleting a user-mode thread frees only its control block and not the privileged kernel stack allocated with it. A module that repeatedly creates and deletes threads drains a finite shared object pool, so later module thread or object creation fails for the whole system (denial of service).","category":"runtime","nicknames":[],"who_cares":["threadx","embedded","rtos"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Shared kernel object pool exhausted, blocking new module threads system-wide","analyst_note":"Sources list no affected or fixed versions and no advisory link beyond NVD; find the vendor (Eclipse ThreadX) advisory and patched release.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-user-mode-modules"],"who_is_affected":"Systems running ThreadX with the user-mode Module Manager, where loaded modules create and delete threads. Only memory-protected modules are described as affected. Systems without the Module Manager or without user-mode modules are unlikely to be exposed; the sources do not name specific versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3647,"output_tokens":482,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-95108':17A,20A 'alloc':47B,98C,114C,124C,167C,185C 'anywher':266C 'ask':103C 'block':40B,109C,150C,216C 'byte':131C 'call':141C 'come':152C 'common':280C 'control':39B,108C,149C 'cost':89C 'creat':54B,119C,196C,252C,265C 'creation':70B 'cve':15A,18A 'cycl':233C 'delet':2A,30B,56B,175C,199C,277C 'denial':76B 'dispatch':176C,278C 'drain':58B 'embed':21B 'everi':204C,208C,227C,232C 'exhaust':12A,245C 'fail':71B 'finit':60B,219C 'first':180C 'fix':215C 'free':36B 'function':271C 'kernel':10A,45B,128C,135C,182C,254C 'later':65B 'leak':8A 'link':162C 'list':168C 'load':229C,240C 'logic':80C 'long':236C 'loop':203C 'manag':29B,92C,117C,156C,171C,224C,274C 'memori':248C 'memory-protect':247C 'mode':6A,34B,86C,260C 'modul':28B,51B,66B,88C,91C,102C,112C,116C,127C,155C,165C,170C,189C,194C,230C,250C,261C,273C 'modules/module_manager/inc/txm_module_manager_dispatch.h':281C 'object':62B,69B,95C,113C,157C,255C 'one':79C,100C 'onto':163C 'pool':14A,63B,96C,158C,220C,243C 'privileg':44B,134C 'protect':249C 'record':145C 'releas':177C 'remov':213C 'repeat':53B 'return':210C 'rtos':22B 'run':142C 'runtim':23B 'second':123C 'servic':78B,209C 'share':61B,94C,221C 'size':130C 'stack':11A,46B,129C,136C,183C 'state':205C 'stay':184C,239C 'stop':191C 'success':212C 'system':75B,140C,269C 'take':121C 'termin':197C 'thread':7A,35B,57B,67B,81C,107C,118C,138C,174C,200C,262C,276C 'thread-delet':173C 'threadx':1A,24B,27B,87C 'transit':206C 'two':97C 'tx':106C,211C,275C 'txm':111C,115C,126C,154C,272C 'user':5A,33B,85C,259C 'user-mod':4A,32B,84C,258C 'valid':207C 'vulner':270C 'whole':74B,188C","nicknames":[],"mitigations":[],"who_affected":"Systems running ThreadX with the user-mode Module Manager, where loaded modules create and delete threads. Only memory-protected modules are described as affected. Systems without the Module Manager or without user-mode modules are unlikely to be exposed; the sources do not name specific versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95108","severity":null,"published_at":"2026-10-20T16:17:18+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}