Privilege Escalation in Eclipse ThreadX Due to Inadequate Callback Management

CVE-2026-113421

What is CVE-2026-113421?

In Eclipse ThreadX versions 6.0.1 to 6.5.2.202603, an issue arises when the system does not adequately manage the trace-buffer-full callback after a module is stopped and unloaded. If event tracing is enabled and the kernel-owned trace buffer remains active, a buffer wrap can trigger the callback from a privileged thread context. This enables a user-mode module to execute its code with kernel privileges after the module's code has been released. Additionally, upon reuse of the memory, it may lead to redirected control flow or system faults.

References