CVE-2026-108952
4.6MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-843
Impact
A physically connected USB host can trigger a denial of service by crashing the device via memory corruption. The attacker needs physical access to connect to the target device's USB port.
Root cause
The legacy USB CDC virtual COM port driver incorrectly aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(), corrupting adjacent structure members and issuing an invalid free.
Affected systems
RT-Thread through 5.3.0
CVSS v3.1 · CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Apply commit ceef6e0ccd646aef61b907aeb9f29269d1caba50 or update to a release past 5.3.0. If patching immediately is not feasible, disable the legacy USB CDC VCOM driver in your RT-Thread kernel configuration.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.
References
- https://github.com/RT-Thread/rt-thread
- https://github.com/RT-Thread/rt-thread/blob/99428a1e7f7447955aa860f7c969273a12095b8f/components/legacy/usb/usbdevice/class/cdc_vcom.c#L518
- https://github.com/RT-Thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50
- https://github.com/RT-Thread/rt-thread/issues/11739
- https://github.com/RT-Thread/rt-thread/pull/11770
- https://www.vulncheck.com/advisories/rt-thread-through-5.3.0-memory-corruption-via-usb-cdc-vcom-driver