ThreadX Module Manager's Memory Management Flaw

CVE-2026-95108

What is CVE-2026-95108?

The ThreadX Module Manager contains a flaw in its memory allocation process where a single user-mode thread allocation results in the consumption of two resources from the shared object pool. This occurs when a module requests a control block and inadvertently allocates additional memory for the privileged kernel stack within the module's thread operations. Consequently, if the thread-delete dispatcher only releases the initial allocation, the kernel stack remains allocated, which can lead to resource exhaustion over time. As modules create and delete threads in a loop, they deplete the finite memory pool, ultimately preventing the creation of new threads across the system, potentially disrupting operations severely.

References