Live › vulnerability › CVE-2026-95109
Go to dashboardThe Cortex-A7 MMU Modules port checks only the first byte of a caller-supplied buffer instead of the full range. A memory-protected module can therefore pass a range that extends into privileged memory, and privileged code then reads or writes past the check.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Firmware teams using Eclipse ThreadX (Azure RTOS) on Cortex-A7 with the memory-protected Modules feature and loading modules that are not fully trusted. A module that can make ordinary system calls can make privileged code read or write past the checked range, or fault the kernel. Skip it if you do not use Modules, use another CPU port, or load only modules you build yourself. Impact depends on what sits next to a module mapping; an unmapped guard after every module region reduces it to a kernel fault.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Eclipse ThreadX | vendor | >= 6.1, <= 6.5.1.202602a | 6.5.2.202603 |
6.5.1.202602a (check the version in the tree or the tag, v6.1_rel through v6.5.1.202602a_rel) for the Cortex-A7 MMU Modules port (GNU, AC5 or IAR) with TXM_MODULE_MEMORY_PROTECTION defined6.5.2.202603 (the same release fixes eight other Module Manager vulns)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating one address — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start.
A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.
This page as .md · .json · in your agent: get_signal("CVE-2026-95109")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.