CVE-2026-102710: Critical severity Microsoft Azure Rtos Threadx vulnerability
Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE.
A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps.
An invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (CONTROL.nPRIV = 0), confirmed at runtime with a register capture inside that code.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when they use a build with TX_ENABLE_EVENT_TRACE and load a module configured with both TXM_MODULE_USER_MODE and TXM_MODULE_MEMORY_PROTECTION. The vulnerable path requires that module to issue kernel dispatch calls and the trace buffer to wrap.
What level of access does an attacker need?
An attacker needs the ability to control a loaded user-mode, memory-protected module that can make kernel dispatch calls. That module can register an arbitrary global trace-full callback pointer.
What can exploitation achieve?
An invalid callback pointer can fault the kernel, causing denial of service. A callback pointer targeting code in the module can result in that code executing with privileged kernel access, with CONTROL.nPRIV observed as 0.
How can I determine whether my system is affected?
Check whether the build enables TX_ENABLE_EVENT_TRACE and whether it loads modules with both TXM_MODULE_USER_MODE and TXM_MODULE_MEMORY_PROTECTION. Affected systems permit such a module to register the global trace-full callback through kernel dispatch calls; the callback is invoked when the trace buffer wraps.