Eclipse ThreadX up to 6.5.1.202602a Module Manager txm_module_manager_dispatch.h _txm_module_manager_tx_thread_delete_dispatch resource consumption

Summaryinfo

A vulnerability identified as critical has been detected in Eclipse ThreadX up to 6.5.1.202602a. Affected by this issue is the function _txm_module_manager_tx_thread_delete_dispatch of the file common_modules/module_manager/inc/txm_module_manager_dispatch.h of the component Module Manager. Performing a manipulation results in resource consumption. This vulnerability is reported as CVE-2026-95108. The attack requires a local approach. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Eclipse ThreadX up to 6.5.1.202602a. It has been classified as critical. This affects the function _txm_module_manager_tx_thread_delete_dispatch of the file common_modules/module_manager/inc/txm_module_manager_dispatch.h of the component Module Manager. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD` control block through `txm_module_object_allocate`; `_txm_module_manager_thread_create` then takes a second allocation of `TXM_MODULE_KERNEL_STACK_SIZE` bytes for the privileged kernel stack that thread's system calls run on, and records it in the control block. Both come from `_txm_module_manager_object_pool` and both are linked onto the module's allocation list. The Module Manager's thread-delete dispatcher released only the first. The kernel stack stayed allocated until the whole module was stopped, so a module that creates, terminates and deletes threads in a loop — every state transition valid, every service returning `TX_SUCCESS` — removed a fixed block from a finite pool shared by the manager and by every other loaded module, on every cycle, for as long as it stayed loaded. Once the pool is exhausted, no memory-protected module can create any kernel object and no user-mode module thread can be created anywhere in the system. Vulnerable function: `_txm_module_manager_tx_thread_delete_dispatch`, in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-95108 since 09/23/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.5.2.202603 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.5.1.202602a

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion