CVE-2026-102710

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-11-03

Assigner: Eclipse Foundation

Description

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from privileged code when the trace buffer wraps. A malicious module can thereby run its own code with kernel privilege, defeating module isolation, or fault the kernel with an invalid pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-09-29

EPSS Evaluated

2026-11-07

NVD

CVE-2026-102710

EUVD

EUVD-2026-89173

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse Foundation	eclipse-threadx/threadx	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-822	The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability allows a user-mode module with specific permissions to register a malicious function pointer as a kernel trace callback. When the kernel's trace buffer wraps, it executes this pointer directly without validation, potentially causing a kernel fault (DoS). The pointer can run with kernel privileges, as observed in testing.

Detection Guidance

This vulnerability requires detecting invalid function pointers registered as trace-full callbacks in kernel modules. Monitor kernel logs for unexpected faults or crashes during trace buffer operations. Check for modules loaded with TXM_MODULE_USER_MODE and TXM_MODULE_MEMORY_PROTECTION flags. Use kernel debuggers to inspect trace callback registrations.

Impact Analysis

An attacker could exploit this to crash the system (DoS) by providing an invalid pointer. If the pointer points to malicious code, it could execute with kernel privileges, leading to full system compromise, data theft, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data security) by exposing sensitive information or disrupting critical systems.

Mitigation Strategies

Disable trace buffer wrapping in affected modules by setting TX_ENABLE_EVENT_TRACE to false. Ensure all loaded modules validate function pointers before registration. Apply patches from the vendor if available. Restrict module loading to trusted sources only.

Hi! I’m here to help you understand CVE-2026-102710. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...