Skip to content
Heist/ feed
Medium

Module Manager object lookup validates one byte of a module's search name

Type: advisorySource: Official CVE List1 source record

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended `txm_module_object_pointer_get_extended` is handed a length and does not use it to bound the buffer, and the deprecated `txm_module_object_pointer_get` supplies the largest value a `UINT` can hold, so it removes the bound rather than lacking one. A module can make the walk unbounded without knowing anything about the memory it reaches, and where the walk reaches memory a privileged read cannot take, the resulting fault leaves the kernel unable to preempt for the rest of the system's life. Vulnerable functions: `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch` (both in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`) and `_txm_module_manager_object_name_compare` (`common_modules/module_manager/src/txm_module_manager_util.c`).

Announced Group revision 1
Original source ↗

CVE-2026-94024

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-94024

Eclipse ThreadX

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Eclipse Foundation",
    "product": "Eclipse ThreadX",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.1",
        "versionType": "semver",
        "lessThanOrEqual": "6.5.1.202602a"
      },
      {
        "status": "unaffected",
        "version": "6.5.2.202603"
      }
    ],
    "packageName": "ThreadX",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-94024

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#42407 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement