{"id":"CVE-2026-102710","published":"2026-09-29T18:17:10.020","lastModified":"2026-09-29T19:00:16.623","description":"Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`.\n\n\n\nA user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps.\n\n\n\nAn invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (`CONTROL.nPRIV = 0`), confirmed at runtime with a register capture inside that code.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-269","CWE-822"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-xr9m-8j99-rw4m","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-xr9m-8j99-rw4m","tags":[]}],"hasPoc":true,"ai":null}