CVE-2026-94023
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch…
- Risk score
- 42/100
- CVSS
- 6.9 v4.0
- Exploit chance (30 days)
- 0.1%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using an object a module does not own is supported and intended — …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.9 medium
References
Original description
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* an object, and using an object a module does not own is supported and intended — `txm_module_object_pointer_get_extended` searches the system's created objects by name and hands back objects the application created and objects other modules created, so that a module can send to a shared queue, take a shared semaphore or get a shared mutex. Destroying one of those is not sharing it. A module could name any object it had a pointer to and have the privileged dispatcher delete it.
Last activity 20 Oct 2026. Patch Forecast updates every hour.