# CVE-2026-14629: RT-Thread RTOS denial of service in serial device ioctl handler

Source: https://junglewise.ai/threats/cve-2026-14629-rt-thread-rtos-denial-of-service-in-serial-device-ioctl-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-04. Updated: 2026-07-04  
License: CC BY 4.0 with a link back

CVE-2026-14629 · Severity: medium · CVSS 4.3 · Published 2026-07-04

RT-Thread is an open-source real-time operating system (RTOS) widely used in Internet of Things (IoT) devices. A security flaw in how the system handles communication with serial devices (like sensors or diagnostic ports) allows a user to crash the entire operating system. This could lead to a complete service outage for the affected device, requiring a manual restart to restore operations.

Technologies: [RT-Thread](https://junglewise.ai/threats/technologies/rt-thread). Vendors: [RT-Thread](https://junglewise.ai/threats/vendors/rt-thread).

## Quick answers

**Is CVE-2026-14629 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14629 being exploited in the wild.

**How severe is CVE-2026-14629?** Medium severity, with a CVSS score of 4.3, published 4 July 2026.

**Which products and versions are affected?** RT-Thread up to 5.2.2.

**Is there a fix for CVE-2026-14629?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14629 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-14629?** Check whether you run RT-Thread at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the RT-Smart LWP (Lightweight Process) syscall layer of RT-Thread up to 5.2.2. The `sys_ioctl` function in `components/lwp/lwp_syscall.c` fails to validate or copy user-space pointers before passing them to the kernel-side `rt_device_control`. When targeting serial devices, an attacker can provide an invalid pointer, leading to a kernel crash during dereference in `rt_serial_control`. Additionally, by providing a valid pointer to a structure with a `baud_rate` of zero, an attacker can trigger a divide-by-zero error in board-specific UART drivers (such as the imx6ull-smart BSP). A pull request (#11453) has been submitted to harden pointer handling and validate configuration parameters.

## Affected products

- RT-Thread RT-Thread up to 5.2.2

## Timeline

- 2026-06-09: disclosed: Issue reported on GitHub and fix proposed via pull request
- 2026-07-04: advisory: CVE published by VulDB

## References

- [https://github.com/RT-Thread/rt-thread/](https://github.com/RT-Thread/rt-thread/)
- [https://github.com/RT-Thread/rt-thread/issues/11429](https://github.com/RT-Thread/rt-thread/issues/11429)
- [https://github.com/RT-Thread/rt-thread/pull/11453](https://github.com/RT-Thread/rt-thread/pull/11453)
- [https://vuldb.com/cve/CVE-2026-14629](https://vuldb.com/cve/CVE-2026-14629)
- [https://vuldb.com/submit/845610](https://vuldb.com/submit/845610)
- [https://vuldb.com/vuln/376145](https://vuldb.com/vuln/376145)
- [https://vuldb.com/vuln/376145/cti](https://vuldb.com/vuln/376145/cti)

## Related threats

- [RT-Thread USB CDC memory corruption in ring buffer](https://junglewise.ai/threats/cve-2026-108952-rt-thread-through-5-3-0-contains-a-memory-corruption)
- [RT-Thread memory corruption in sys_getaddrinfo syscall](https://junglewise.ai/threats/cve-2026-14607-rt-thread-memory-corruption-in-sys-getaddrinfo-syscall)
- [RT-Thread SWM341 CAN Handler stack buffer overflow in CAN_Receive](https://junglewise.ai/threats/cve-2026-14606-rt-thread-swm341-can-handler-stack-buffer-overflow-in-can-receive)
- [RT-Thread stack overflow in ls1c CAN Handler recvmsg](https://junglewise.ai/threats/cve-2026-14605-rt-thread-stack-overflow-in-ls1c-can-handler-recvmsg)