An Eclipse ThreadX build that enables event tracing allows a user‑mode module marked with memory protection to register a global trace‑full callback function pointer. The kernel invokes this pointer directly when the trace buffer wraps, with no validation or trampoline. If the pointer is invalid or points into the module’s own code, the kernel performs an unrestricted call from privileged code, causing a fault that crashes the kernel. The result is a denial of service that can be triggered by loading an arbitrary module and causing a trace‑buffer wrap.

Eclipse ThreadX is the affected product. Builds that compile with TX_ENABLE_EVENT_TRACE and that load user‑mode, memory‑protected modules (TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION) are vulnerable. No specific release version is listed, so the issue applies to all ThreadX versions with the vulnerable configuration.

The CVSS score of 9.3 indicates critical severity. Although no EPSS score is available and the vulnerability is not listed in KEV, the exploitation path is straightforward once a module can be loaded: register the bad callback and trigger a trace‑buffer wrap to cause the crash. The lack of validation in the kernel code makes the risk high; an attacker with the ability to load modules can repeatedly bring down systems without additional privileges.