VxWorks 7 CVE-2026-102006

Requires the ability to execute code locally on the VxWorks 7 device (a process or task, at least unprivileged) that can issue process-management system calls (AV:L, PR:L). Exploitation further depends on supplying the specific system-call arguments that trigger the missed kernel-memory free path, and on repeated invocation to accumulate enough leaked memory to exhaust the kernel pool and cause denial of service. Limiting factors: no remote or network vector, no unauthenticated reach, and no user interaction is involved (UI:N) - an attacker must first gain local execution on the RTOS, which sharply narrows realistic exploitation. Affected builds are all VxWorks 7 releases prior to 26.09; upgrading to 26.09 removes the flaw.

This is a genuine but low-to-moderate priority issue. All exploitation signals point to a locally-triggered availability-only defect, not a remotely weaponizable one. The vendor CVSS3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: the flaw is reached by passing specific arguments to a process-management system call, which inherently requires the ability to execute code on the device (AV:L) with at least an unprivileged account or task context (PR:L). There is no EPSS score, no CISA KEV listing, and no public POC - meaning no evidence of active or automated exploitation. The impact is confined to a CWE-401 memory leak: kernel memory is not released before the calling application terminates, so repeated invocation gradually exhausts kernel memory and degrades or crashes the system (A:H), with no confidentiality or integrity effect (C:N/I:N). NOTE A CONFLICT: the input Tags label this 'Information Disclosure,' which directly contradicts the description and CVSS vector - this is an availability/resource-exhaustion bug, not an info-leak (C:N). Treat the tag as erroneous. Overall this is a high-CVSS-context product with a real but narrow, local-only, denial-of-service issue - patch on a normal maintenance cadence rather than as an emergency.

A local unprivileged process or task running on a VxWorks 7 device repeatedly invokes a process-management system call with the specific argument pattern that skips the kernel-memory free path. Each call leaks kernel memory until the pool is exhausted, degrading the RTOS and eventually crashing the calling application or destabilizing the system. No public exploit code exists, and the attacker must already be able to run code on the device.