CVE-2026-14629: RT-Thread RCE Vulnerability

CVE-2026-14629 Overview

CVE-2026-14629 is a divide-by-zero flaw [CWE-369] in RT-Thread through version 5.2.2. The issue resides in the read, write, and sys_ioctl functions within components/lwp/lwp_syscall.c, part of the Parameter Handler component. An authenticated attacker can trigger the condition by supplying crafted parameters to the affected syscalls, resulting in a denial-of-service condition on the affected embedded system. The exploit has been published, and a pull request to remediate the flaw is pending upstream acceptance.

Critical Impact
Successful exploitation causes the RT-Thread real-time operating system kernel to encounter an arithmetic exception, disrupting availability of embedded and IoT workloads that depend on it.

Affected Products

RT-Thread real-time operating system versions up to and including 5.2.2
Embedded and IoT devices running the affected RT-Thread lwp subsystem
Systems relying on components/lwp/lwp_syscall.c syscall handlers

Discovery Timeline

2026-07-04 - CVE-2026-14629 published to the National Vulnerability Database
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14629

Vulnerability Analysis

The vulnerability is a divide-by-zero condition [CWE-369] in the syscall dispatch path of RT-Thread's lightweight process (lwp) subsystem. The affected read, write, and sys_ioctl handlers in components/lwp/lwp_syscall.c perform arithmetic operations on caller-supplied parameters without validating that divisors are non-zero. When a userspace process invokes one of these syscalls with a zero-valued parameter used as a divisor, the kernel triggers an arithmetic exception. This produces an availability impact consistent with the CVSS vector, which indicates no confidentiality or integrity loss but a low availability effect. The EPSS probability of 0.309% suggests limited near-term exploitation likelihood, though a public proof-of-concept exists.

Root Cause

The root cause is missing input validation on parameters passed to syscall handlers. The affected functions perform division or modulo operations using attacker-controlled values without first confirming the divisor is non-zero. This is a classic instance of [CWE-369: Divide By Zero].

Attack Vector

Exploitation requires low-privileged local access to invoke the syscall interface, though the CVSS 4.0 vector marks the attack vector as network, reflecting scenarios where RT-Thread exposes remote services that funnel data into the vulnerable syscalls. An attacker submits crafted arguments to read, write, or sys_ioctl, causing the kernel to attempt division by zero. See the GitHub Issue #11429 and the proposed fix in Pull Request #11453 for technical specifics.

Detection Methods for CVE-2026-14629

Indicators of Compromise

Unexpected kernel panics or arithmetic exception traps originating from the lwp_syscall code path
Repeated syscall failures or process terminations tied to read, write, or sys_ioctl invocations
Device reboots or watchdog resets correlated with untrusted input reaching syscall handlers

Detection Strategies

Instrument RT-Thread builds with kernel fault logging to capture divide-by-zero exceptions and the calling process context
Audit source trees for the vulnerable components/lwp/lwp_syscall.c code path and confirm whether the Pull Request #11453 fix has been merged
Monitor network-facing services on embedded devices for anomalous input patterns that reach syscall handlers

Monitoring Recommendations

Centralize device crash logs and correlate kernel exceptions across a fleet to identify systemic exploitation attempts
Alert on abnormal reboot frequency for devices running RT-Thread up to 5.2.2
Track upstream RT-Thread commits and release notes for the merge of the pending fix

How to Mitigate CVE-2026-14629

Immediate Actions Required

Inventory all embedded and IoT assets running RT-Thread and identify builds at or below version 5.2.2
Restrict network exposure of RT-Thread devices to trusted management segments until a patched build is available
Apply the patch from Pull Request #11453 manually to affected firmware builds after review

Patch Information

At the time of publication, the fix for CVE-2026-14629 is proposed in Pull Request #11453 against the RT-Thread repository and awaits upstream acceptance. Vendors integrating RT-Thread should track the pull request and rebuild firmware once merged. Additional context is available via the VulDB entry for CVE-2026-14629.

Workarounds

Add divisor validation locally in read, write, and sys_ioctl handlers within components/lwp/lwp_syscall.c before arithmetic operations execute
Constrain which userspace processes can invoke the affected syscalls through least-privilege application design
Deploy watchdog and automatic recovery mechanisms to limit downtime if the flaw is triggered

bash

# Configuration example: verify RT-Thread version and pending patch status
git -C rt-thread log --oneline v5.2.2..HEAD -- components/lwp/lwp_syscall.c
git -C rt-thread fetch origin pull/11453/head:cve-2026-14629-fix
git -C rt-thread diff main..cve-2026-14629-fix -- components/lwp/lwp_syscall.c