---
id: CVE-2026-113421
title: ThreadX Modules invokes trace-full callbacks after module unload
summary: >-
  In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does
  not revoke a module's trace-buffer-full callback when the module is stopped
  and unloaded. With event tracing enabled and a kernel-owned trace buffer still
  activ…
severity: high
cvss: 7.3
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-416
vendor: Eclipse Foundation
product: Eclipse ThreadX
affected:
  - eclipse_threadx >= 6.0.1 <= 6.5.2.202603
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T20:10:12.940490Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:10:26.990Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113421'
references:
  - url: >-
      https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-8pgj-qvjv-j4fq
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/457'
tags:
  - cve.org
epss: 0.00107
epssPercentile: 0.01131
ingestedAt: '2026-11-05T20:33:06.432Z'
---

## Overview

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.

## Affected

- `eclipse_threadx >= 6.0.1 <= 6.5.2.202603`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.