CVE-2026-94192

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94192

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94192.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94192

Aliases

GHSA-57mf-w87f-rq7m

Published

2026-10-20T15:15:06Z

Modified

2026-10-21T03:00:18Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Module object deallocation can free a live ThreadX kernel object

Details

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txm_module_object_deallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.

Database specific

{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-416",
        "CWE-664"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94192.json"
}

References

Affected packages

Git / github.com/eclipse-threadx/threadx

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/threadx

Events

Introduced

6a018a4cfda937c0d8cbdee761187c5c5843e115

Last Affected

b91b03b9e75fa523b17127f9e0eca09dca916459

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "6.0.1"
                },
                {
                    "last_affected":  "6.5.1.202602a"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v6.*

v6.0.1_rel

v6.0.2_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.1_rel

v6.1.2_rel

v6.1.3_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

v6.3.0_rel

v6.4.0_rel

v6.4.1_rel

v6.4.2_rel

v6.4.3.202503_rel

v6.4.5.202504_rel

v6.5.0.202601_rel

v6.5.1.202602_rel

v6.5.1.202602a_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94192.json"