ThreadX Module Manager Use-After-Free Flaw Exposes Kernel Objects

Eclipse ThreadX contains a use-after-free vulnerability within its Module Manager component. This flaw allows the system to release memory addresses that are still actively used by kernel objects. Security operations teams should assess environments running vulnerable ThreadX versions for potential exposure. The issue stems from how the module handles control block deallocation requests.

Root cause

The vulnerability arises when a ThreadX module requests memory return via `txm_module_object_deallocate`. The Module Manager releases the memory regardless of its current content. This includes control blocks that the kernel is still utilising. The deallocation process does not remove the object from its created list. Consequently, the object remains visible to the system while its underlying memory is freed.

Attack path

Because the object stays on its respective lists, threads remain schedulable and timers stay active. Meanwhile, the byte pool is free to assign those same memory bytes to new allocations. This creates a scenario where new data overwrites active kernel structures. An attacker could potentially manipulate this memory reuse to alter system behaviour or gain control.

Affected versions

• Eclipse ThreadX up to 6.5.1.202602a

Mitigation

• No confirmed fix exists for this vulnerability at this time.
• Review all systems running ThreadX versions prior to the next release.
• Monitor vendor announcements for patches addressing CVE-2026-94192.

Signals worth monitoring

Teams usually detect memory corruption through unexpected application crashes or erratic system behaviour. Check whether logs show sudden thread termination or timer anomalies. Look for access violations in kernel-mode logs. Containment moves often involve isolating affected systems to prevent further memory manipulation. Monitor for unusual scheduling patterns or duplicate object identifiers. Verify that no unauthorised code execution occurs during memory reallocation events.

What to do and how to stay safe: Eclipse ThreadX

• Inventory all devices and software using Eclipse ThreadX to identify vulnerable versions.
• Enable detailed kernel logging to capture memory allocation and deallocation events.
• Restrict network access for systems running unpatched ThreadX until a fix is available.
• Monitor for vendor updates regarding CVE-2026-94192 and apply patches when released.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-94192?

The flaw has a CVSS score of 8.5, which is rated as high severity.

Which versions of ThreadX are affected?

Eclipse ThreadX versions up to 6.5.1.202602a are affected by this vulnerability.

Is there a patch available?

No fix has been confirmed yet for this specific issue.