CVE-2026-102710

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Eclipse Foundation

Description

Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps. An invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (`CONTROL.nPRIV = 0`), confirmed at runtime with a register capture inside that code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102710

EUVD

EUVD-2026-89173

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	eclipse-threadx/threadx 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-822	The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability allows a user-mode module with specific permissions to register a malicious function pointer as a kernel trace callback. When the kernel's trace buffer wraps, it executes this pointer directly without validation, potentially causing a kernel fault (DoS). The pointer can run with kernel privileges, as observed in testing.

Detection Guidance

This vulnerability requires detecting invalid function pointers registered as trace-full callbacks in kernel modules. Monitor kernel logs for unexpected faults or crashes during trace buffer operations. Check for modules loaded with TXM_MODULE_USER_MODE and TXM_MODULE_MEMORY_PROTECTION flags. Use kernel debuggers to inspect trace callback registrations.

Impact Analysis

An attacker could exploit this to crash the system (DoS) by providing an invalid pointer. If the pointer points to malicious code, it could execute with kernel privileges, leading to full system compromise, data theft, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data security) by exposing sensitive information or disrupting critical systems.

Mitigation Strategies

Disable trace buffer wrapping in affected modules by setting TX_ENABLE_EVENT_TRACE to false. Ensure all loaded modules validate function pointers before registration. Apply patches from the vendor if available. Restrict module loading to trusted sources only.

Hi! I’m here to help you understand CVE-2026-102710. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70