eclipse-threadx/threadx v6.5.2.202603b_rel

Eclipse ThreadX v6.5.2.202603b

on GitHub

This hotfix release addresses eight vulnerabilities: seven in ThreadX Modules and one in the TrustZone-M secure stack services. Each needs code already running on the device, in a loaded module or in the non-secure world, and none is reachable over the network. Apart from those fixes, it adds three Module Manager loaders that take the module image's length.

We thank Jo Van Bulck, Tijs Bellefroid, Marton Bognar and Antonis Louka of DistriNet, KU Leuven, SounLabs (@SounLabs), @adawn0106, @testacegi and @alex16848 for reporting these responsibly.

Vulnerabilities addressed

Eight vulnerabilities are fixed in 6.5.2.202603b. All require local code execution and no user interaction.

• CVE-2026-102710 (8.5 High, CWE-269, CWE-822)
  Module Manager passes an unvalidated tx_trace_buffer_full_notify callback to the kernel, which invokes it in privileged context
• CVE-2026-115231 (8.5 High, CWE-269, CWE-862)
  User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
• CVE-2026-102709 (8.4 High, CWE-200, CWE-501, CWE-822)
  Unchecked pointer vulnerabilities in ThreadX TrustZone-M entry functions
• CVE-2026-113421 (7.3 High, CWE-416)
  ThreadX Modules invokes trace-full callbacks after module unload
• CVE-2026-115653 (7.0 High, CWE-787, CWE-822)
  Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
• CVE-2026-102711 (6.9 Medium, CWE-125, CWE-345, CWE-1284)
  Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader
• CVE-2026-115654 (6.9 Medium, CWE-284, CWE-862)
  User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
• CVE-2026-118052 (6.8 Medium, CWE-667, CWE-833)
  Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation

All eight affect every release from 6.0.1, or from the release that introduced the affected port, up to and including 6.5.2.202603.

Behaviour changes

• A user-mode module can no longer register tx_trace_buffer_full_notify (TXM_MODULE_INVALID_PROPERTIES).
• A memory-protected module can no longer send to, flush or receive from another module's callback request queue, or suspend, resume, terminate, reset, re-prioritise or abort the waits of threads it does not own (TXM_MODULE_INVALID). Designs that relied on this need a shared synchronisation object.
• The new loaders txm_module_manager_in_place_load_ext, txm_module_manager_memory_load_ext and txm_module_manager_absolute_load_ext take the image length and reject images whose preamble does not fit it. The four loaders without a length are deprecated; they remain available and gain the entry-point checks.
• The Module Manager loaders now release the manager mutex when a preamble size overflows.

Every fix ships with a regression test that fails without it. The PendSV fix is exercised on QEMU through the module execution harness added in #821. Fixes were not run on hardware.

You can access advisories for previously addressed vulnerabilities here.

Full Changelog: v6.5.2.202603_rel...v6.5.2.202603b_rel