---
id: "CVE-2026-95109"
kind: "vulnerability"
aliases: ["CVE-2026-95109"]
title: "Cortex-A7 MMU port: buffer range check only tests first byte"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Eclipse ThreadX", "fixed": ["6.5.2.202603"], "affected": ">= 6.1, <= 6.5.1.202602a", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cortex-a7", "eclipse-threadx", "embedded", "module-manager", "rtos", "runtime", "threadx"]
not_affected_if: ["no-memory-protection", "no-modules", "other-cpu-port", "trusted-modules-only"]
published_at: "2026-10-20T16:17:18+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:26:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95109", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:26:56+00:00"}]
---

# Cortex-A7 MMU port: buffer range check only tests first byte

The Cortex-A7 MMU Modules port checks only the first byte of a caller-supplied buffer instead of the full range. A memory-protected module can therefore pass a range that extends into privileged memory, and privileged code then reads or writes past the check.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Eclipse ThreadX affected >= 6.1, <= 6.5.1.202602a fixed 6.5.2.202603

## How to check

You are exposed if you build ThreadX 6.1 to 6.5.1.202602a (check the version in the tree or the tag, v6.1_rel through v6.5.1.202602a_rel) for the Cortex-A7 MMU Modules port (GNU, AC5 or IAR) with TXM_MODULE_MEMORY_PROTECTION defined. Other module ports have their own range-complete check and are not affected. 6.0.x predates the port.

## Fix

Upgrade Eclipse ThreadX to 6.5.2.202603 (the same release fixes eight other Module Manager vulns). No workaround that keeps module memory protection; only loading modules you build yourself avoids exposure.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95109
- 2026-10-25T03:26:56+00:00 analyst — Read Eclipse ThreadX GHSA-fvp6-37q5-c648 (maintainer advisory) and release notes: affected 6.1 through 6.5.1.202602a, fixed 6.5.2.202603. No exploitation or public PoC found; social search not run (obscure embedded component).

## Documents

- [advisory] GHSA-fvp6-37q5-c648: Cortex-A7 module data validation checks only the first address https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-fvp6-37q5-c648
- [fix] Eclipse ThreadX releases (6.5.2.202603 fixes nine Module Manager vulns) https://github.com/eclipse-threadx/threadx/releases

## From the sources

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start.



A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_