Executive brief
RT-Thread is an open-source real-time operating system (RTOS) widely used in Internet of Things (IoT) devices. A security flaw in how the system handles communication with serial devices (like sensors or diagnostic ports) allows a user to crash the entire operating system. This could lead to a complete service outage for the affected device, requiring a manual restart to restore operations.
Technical details
A vulnerability exists in the RT-Smart LWP (Lightweight Process) syscall layer of RT-Thread up to 5.2.2. The `sys_ioctl` function in `components/lwp/lwp_syscall.c` fails to validate or copy user-space pointers before passing them to the kernel-side `rt_device_control`. When targeting serial devices, an attacker can provide an invalid pointer, leading to a kernel crash during dereference in `rt_serial_control`. Additionally, by providing a valid pointer to a structure with a `baud_rate` of zero, an attacker can trigger a divide-by-zero error in board-specific UART drivers (such as the imx6ull-smart BSP). A pull request (#11453) has been submitted to harden pointer handling and validate configuration parameters.
Affected products
- RT-Thread RT-Thread up to 5.2.2
Timeline
- 2026-06-09: disclosed: Issue reported on GitHub and fix proposed via pull request
- 2026-07-04: advisory: CVE published by VulDB