CVE-2026-113421— ThreadX Modules invokes trace-full callbacks after module unload
Quick assessment
Affected
Eclipse Foundation Eclipse ThreadX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Eclipse ThreadX 6.0.1 至 6.5.2.202603 版本中，ThreadX 模块在停止并卸载时，不会撤销该模块的“追踪缓冲区已满”回调函数。当启用事件追踪且内核拥有的追踪缓冲区仍处于活动状态时，后续的缓冲区环绕操作会在模块代码已被释放后，从特权线程上下文中调用该回调。这可能导致用户态模块在卸载后以内核权限执行其代码；或者，一旦相关内存被重新分配，攻击者可能借此重定向控制流或引发系统故障。
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1212 · Exploitation for Credential Access T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113421
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ThreadX Modules invokes trace-full callbacks after module unload
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX | 6.0.1 ~ 6.5.2.202603 | - |
|
II. Public POCs for CVE-2026-113421
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113421
请登录查看更多情报信息。
Other References for CVE-2026-113421 (2)
Same Patch Batch · Eclipse Foundation · 2026-11-03 · 5 CVEs total
| CVE-2026-89292 | 9.2 CRITICAL | Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser se |
| CVE-2026-89293 | 8.8 HIGH | Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows u |
| CVE-2026-115231 | 8.5 HIGH | User-mode module can post forged callback requests to another module's callback queue, run |
| CVE-2026-92610 | Improper limitation of paths in py-aspect-model-loader |
IV. Related Vulnerabilities
Same product: Eclipse ThreadX
-
CVE-2026-115231
User-mode module can post forged callback requests to anothe -
CVE-2026-115215
NetX Secure DTLS server allocates a session for each new sou -
CVE-2026-115403
NULL pointer dereference in the BSD raw IPv6 send path when -
CVE-2026-115654
User-mode module can suspend, terminate, re-prioritise and a -
CVE-2026-115653
Cortex-M module ports save a preempted user-mode module thre
Same vendor: Eclipse Foundation
-
CVE-2026-89293
Missing server-side authorization in Eclipse Mnestix Browser -
CVE-2026-89292
Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure -
CVE-2026-92610
Improper limitation of paths in py-aspect-model-loader -
CVE-2026-115231
User-mode module can post forged callback requests to anothe -
CVE-2026-115215
NetX Secure DTLS server allocates a session for each new sou
Same weakness: CWE-416