{"id":"CVE-2026-95109","kind":"vulnerability","aliases":["CVE-2026-95109"],"related":[],"title":"Cortex-A7 MMU port: buffer range check only tests first byte","description":"The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start.\n\n\n\nA memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.","summary":"The Cortex-A7 MMU Modules port checks only the first byte of a caller-supplied buffer instead of the full range. A memory-protected module can therefore pass a range that extends into privileged memory, and privileged code then reads or writes past the check.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Eclipse ThreadX","fixed":["6.5.2.202603"],"affected":">= 6.1, <= 6.5.1.202602a","ecosystem":"vendor"}],"ecosystems":[],"tags":["cortex-a7","eclipse-threadx","embedded","module-manager","rtos","runtime","threadx"],"not_affected_if":["no-memory-protection","no-modules","other-cpu-port","trusted-modules-only"],"how_to_check":"You are exposed if you build ThreadX 6.1 to 6.5.1.202602a (check the version in the tree or the tag, v6.1_rel through v6.5.1.202602a_rel) for the Cortex-A7 MMU Modules port (GNU, AC5 or IAR) with TXM_MODULE_MEMORY_PROTECTION defined. Other module ports have their own range-complete check and are not affected. 6.0.x predates the port.","fix":"Upgrade Eclipse ThreadX to 6.5.2.202603 (the same release fixes eight other Module Manager vulns). No workaround that keeps module memory protection; only loading modules you build yourself avoids exposure.","status":"open","published_at":"2026-10-20T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:00:26+00:00","updated_at":"2026-10-25T03:26:56+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-25T03:00:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Cortex-A7 MMU port: buffer range check only tests first byte","impact":"high","summary":"The Cortex-A7 MMU Modules port checks only the first byte of a caller-supplied buffer instead of the full range. A memory-protected module can therefore pass a range that extends into privileged memory, and privileged code then reads or writes past the check.","category":"runtime","nicknames":[],"who_cares":["cortex-a7","embedded","rtos"],"confidence":0.4,"needs_auth":"unknown","worst_case":"privileged code reads or writes memory beyond the checked range","analyst_note":"Sources are only NVD with no version, product or fix details; confirm the affected port and patched release from the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000517,"input_tokens":3441,"output_tokens":346,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources are only NVD with no version, product or fix details; confirm the affected port and patched release from the vendor advisory.","search":"'-2026':14A,17A '-95109':15A,18A 'a7':3A,23B,37B,85C,124C 'address':98C,115C 'array':190C 'ask':133C 'buffer':6A,51B,94C,184C 'byte':12A,45B,101C,119C,153C 'caller':49B,92C 'caller-suppli':48B,91C 'check':8A,41B,81B,109C 'code':74B,167C 'common':103C 'complet':118C 'consum':182C 'cortex':2A,22B,36B,84C,123C 'cortex-a7':1A,21B,35B,83C,122C 'cve':13A,16A 'defect':197C 'discard':126C 'dispatch':166C,180C 'eclips':25B 'eclipse':19A 'eclipse-threadx':24B 'embed':27B 'everi':176C 'extend':68B 'extra':188C 'extra-paramet':187C 'far':159C 'first':11A,44B,100C,152C 'full':55B 'goe':191C 'hand':106C 'howev':158C 'implement':125C 'individu':202C 'instanc':112C,128C 'instead':52B 'macro':195C 'manag':30B,105C 'memori':59B,71B,144C 'memory-protect':58B,143C 'mmu':4A,38B,86C,135C 'modul':29B,39B,61B,87C,104C,111C,146C,179C 'module-manag':28B 'one':97C,194C 'paramet':189C 'pass':64B,148C 'past':79B 'port':5A,40B,88C 'primit':208C 'privileg':70B,73B,165C 'protect':60B,145C,178C 'protected-modul':177C 'question':138C 'rang':7A,56B,66B,108C,150C,174C 'reach':164C 'read':76B,169C 'readabl':157C 'reli':212C 'rest':161C 'rtos':31B 'runtim':32B 'servic':203C 'singl':137C 'size':120C,131C 'start':114C,141C 'suppli':50B,93C 'test':10A 'therefor':63B,147C 'threadx':20A,26B,33B 'translat':96C 'user':156C 'user-read':155C 'valid':89C 'whole':173C 'whose':151C 'write':78B 'wrote':171C","nicknames":[],"mitigations":[],"who_affected":"Firmware teams using Eclipse ThreadX (Azure RTOS) on Cortex-A7 with the memory-protected Modules feature and loading modules that are not fully trusted. A module that can make ordinary system calls can make privileged code read or write past the checked range, or fault the kernel. Skip it if you do not use Modules, use another CPU port, or load only modules you build yourself. Impact depends on what sits next to a module mapping; an unmapped guard after every module region reduces it to a kernel fault.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:26:56Z","by":"analyst","run_id":720},"products":{"at":"2026-10-25T03:26:56Z","by":"analyst","run_id":720},"workarounds":{"at":"2026-10-25T03:26:56Z","by":"analyst","run_id":720},"how_to_check":{"at":"2026-10-25T03:26:56Z","by":"analyst","run_id":720},"who_affected":{"at":"2026-10-25T03:26:56Z","by":"analyst","run_id":720}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95109","severity":null,"published_at":"2026-10-20T16:17:18+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95109:720","url":null,"severity":null,"published_at":"2026-10-25T03:26:56+00:00","modified_at":"2026-10-25T03:26:56+00:00","first_seen_at":"2026-10-25T03:26:56+00:00","fetched_at":"2026-10-25T03:26:56+00:00","note":"Read Eclipse ThreadX GHSA-fvp6-37q5-c648 (maintainer advisory) and release notes: affected 6.1 through 6.5.1.202602a, fixed 6.5.2.202603. No exploitation or public PoC found; social search not run (obscure embedded component)."}],"documents":[{"id":3177,"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-fvp6-37q5-c648","title":"GHSA-fvp6-37q5-c648: Cortex-A7 module data validation checks only the first address","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3178,"url":"https://github.com/eclipse-threadx/threadx/releases","title":"Eclipse ThreadX releases (6.5.2.202603 fixes nine Module Manager vulns)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}