CVE-2026-108952 in RT-Thread
Summary
by MITRE • 10/12/2026
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in RT-Thread versions up to 5.3.0 represents a critical memory corruption flaw within the legacy USB Communication Device Class (CDC) virtual COM port driver implementation. This specific defect arises from an improper aliasing mechanism during the initialization and configuration phases of the serial interface. Specifically, when the function _function_enable() is invoked to activate the CDC device, the system incorrectly maps the receive ring buffer, referred to as rx_ringbuffer, to a structure designated for Serial V2 rt_serial_rx_fifo. This misalignment creates a fundamental disconnect between the memory allocation expectations and the actual data structures in use, setting the stage for severe integrity violations when data is processed or resources are released.
The operational impact of this vulnerability is triggered by an active connection from a USB host that configures the CDC device. Once configured, the driver attempts to manage incoming serial data using the incorrectly aliased structure. Because the memory layout and size expectations differ between the intended Serial V2 FIFO structure and the actual ring buffer implementation, write operations exceed the allocated boundaries of the rx_ringbuffer. This out-of-bounds write allows an attacker or a maliciously configured host device to overwrite adjacent memory regions containing members of the struct vcom object. Such heap-based buffer overflows can lead to arbitrary code execution if the overwritten data includes function pointers or control flow metadata, although in this specific context, it primarily manifests as instability and resource corruption.
Furthermore, the vulnerability extends beyond simple data overflow into a denial-of-service condition during the teardown phase of the connection. When the USB session is closed, the driver attempts to free memory associated with the receive buffer using an invalid rt_free() call. Since the pointer passed to this deallocation function does not correspond correctly to the originally allocated block due to the earlier aliasing error, the operation fails or corrupts the heap metadata. This results in a crash of the RT-Thread kernel or the specific task managing the USB stack, effectively causing a denial of service for any other processes relying on system stability and connectivity.
From a classification perspective, this issue aligns with CWE-120, Buffer Copy without Checking Size of Input, as it involves writing data beyond the bounds of an allocated buffer due to incorrect pointer handling. Additionally, the mechanism of exploiting memory corruption through USB interface configuration relates to CWE-787, Out-of-bounds Write, and potentially CWE-416, Use After Free, given the invalid deallocation attempt. In terms of adversarial tactics, this vulnerability could be leveraged within the MITRE ATT&CK framework under techniques related to Initial Access via peripheral devices or Execution through driver exploitation, particularly if an attacker can physically connect a malicious USB device that triggers the configuration sequence and subsequent memory corruption.
Mitigation strategies for this vulnerability primarily involve upgrading RT-Thread to a version later than 5.3.0 where the aliasing logic in _function_enable() has been corrected to ensure proper separation between ring buffer structures and Serial V2 FIFO objects. For systems unable to upgrade immediately, implementing strict input validation on USB configuration requests can help prevent the triggering of the vulnerable code path. Additionally, enabling heap protection mechanisms such as guard pages or randomized allocation strategies may mitigate the impact of out-of-bounds writes by making it more difficult for attackers to predict memory layouts and achieve reliable exploitation. Regular auditing of driver implementations against standard memory safety guidelines is also recommended to identify similar aliasing errors in other peripheral drivers.