An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary.

{
                    "vendor": "Eclipse Foundation",
                    "product": "ThreadX",
                    "packageName": "ThreadX",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "6.0.1",
                            "lessThanOrEqual": "6.5.1.202602a",
                            "versionType": "semver"
                        },
                        {
                            "status": "unaffected",
                            "version": "6.5.2.202603"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }