Issues

• [Bug] lwp: sys_poll nfds wraparound on 32-bit RT-Smart — 8-byte heap block walked as 0x20000001 entries, kernel heap OOB read/write and crash

  RT-Thread/rt-thread#11925 · Filter by author XueDugu opened on Oct 23, 2026
  1

• [Bug] [libc] timer_gettime 拆秒前将总纳秒截断为 uint32_t，剩余时间查询错误

  RT-Thread/rt-thread#11924 · Filter by author dongly opened on Oct 23, 2026
  1

• [Bug] [libc] gmtime_r 对负时间戳返回非法日历字段

  RT-Thread/rt-thread#11923 · Filter by author dongly opened on Oct 23, 2026
  1

• [Bug] [libc] settimeofday 在 time64/long32 配置下窄化校验，错误拒绝有效时间戳

  RT-Thread/rt-thread#11922 · Filter by author dongly opened on Oct 23, 2026
  1

• [Bug] nvme: kernel heap memory leak per inactive namespace in nvme_scan_device() exhausts system heap and can brick boot

  in progress
  RT-Thread/rt-thread#11919 · Filter by author XueDugu opened on Oct 22, 2026
  5

  

• [Bug] dfs nfs: nfs_read uses the server READ count as memcpy length and overwrites the return address

  RT-Thread/rt-thread#11917 · Filter by author XueDugu opened on Oct 21, 2026
  2

• [Bug] raw-API DHCP server reads client option values without bounds checks (OOB read)

  bugcomponent: netComponent
  RT-Thread/rt-thread#11913 · Filter by author K-ANOY opened on Oct 21, 2026
  1

• [Bug][tools] scons --attach 在中文 Windows（GBK 控制台）下抛 UnicodeEncodeError

  in progress
  RT-Thread/rt-thread#11906 · Filter by author Yunlk opened on Oct 20, 2026
  3

  

• [Bug] cromfs: directory name_size is not bounded, ls/getdents overflows the dirent buffer and hijacks the kernel PC

  in progress
  RT-Thread/rt-thread#11905 · Filter by author XueDugu opened on Oct 20, 2026
  5

  

• [Bug] dfs_v2 tmpfs: ftruncate(fd, 0) frees the file buffer but reports success — use-after-free read/write and double free from a legal POSIX call

  in progress
  RT-Thread/rt-thread#11902 · Filter by author XueDugu opened on Oct 19, 2026
  4

  

• [Bug] libdl/dlmodule: no bounds validation on ELF relocation metadata - malformed .mo gives arbitrary kernel-mode memory write with controlled value during load

  RT-Thread/rt-thread#11898 · Filter by author XueDugu opened on Oct 18, 2026
  2

• [Bug] lwp: sys_sigaction missing signal-number range check allows out-of-bounds read/write in kernel heap (RT-Smart)

  RT-Thread/rt-thread#11882 · Filter by author XueDugu opened on Oct 17, 2026
  1

• [Bug] OFW fdt_unflatten_single: unbounded device-tree nesting depth overflows the 64-entry np_stack kernel stack array at boot (components/drivers/ofw/fdt.c)

  RT-Thread/rt-thread#11879 · Filter by author XueDugu opened on Oct 17, 2026
  1

• [Bug] lwip-dhcpd: dhcp_client_alloc infinite loop after lease pool exhaustion — pre-auth remote permanent DoS of the whole lwIP stack (dhcp_server_raw.c)

  RT-Thread/rt-thread#11878 · Filter by author XueDugu opened on Oct 17, 2026
  1

• [Bug] 9PFS: unaligned 64-bit loads in Rstat parsing fault on ARMv7-A — any 9P server reply to Tstat causes a kernel data abort (remote DoS)

  Arch: ARM/AArch64bugComponent
  RT-Thread/rt-thread#11868 · Filter by author XueDugu opened on Oct 15, 2026
  1

• [Feature] Support STM32F103C6 (32KB Flash, 10KB RAM) on stm32f103-blue-pill

  Arch: ARM/AArch64BSP: STM32BSPenhancement
  RT-Thread/rt-thread#11854 · Filter by author avm1234567 opened on Oct 7, 2026
  1

• [Bug] Heap Buffer Overflow in FinSH msh_auto_complete_path via Oversized Input

  Arch: ARM/AArch64BSP: STM32BSPbugcomponent: finshComponentin progress
  RT-Thread/rt-thread#11839 · Filter by author Acen28 opened on Sep 25, 2026
  3

  

• [Bug] wrong impl of vsnprintf

  bugin progressKernel
  RT-Thread/rt-thread#11833 · Filter by author luchenxu73 opened on Sep 24, 2026
  3

  

• [bsp][stm32][bluepill] README「快速上手」缺少重新生成 MDK 工程这一步，按文档操作无法编译通过

  in progress
  RT-Thread/rt-thread#11818 · Filter by author Ren6694 opened on Sep 21, 2026
  4

  

• OSPP 2026 idea: Lazy FP/RVV context switching for RISC-V

  Arch: RISC-VenhancementKernel
  RT-Thread/rt-thread#11786 · Filter by author PiyushPatle26 opened on Sep 7, 2026
  8

• [Bug] pin_api_attach_irq legacy path publishes hdr and args without IRQ protection

  bugcomponent: driversComponent
  RT-Thread/rt-thread#11784 · Filter by author andrewlihhh opened on Sep 7, 2026
  4

• [Bug] [cherryusb] [EHCI] 未刷新SETUP包缓存，导致enumerate fail

  Arch: ARM/AArch64BSP: NuvotonBSPbugcomponent: driversComponent
  RT-Thread/rt-thread#11749 · Filter by author Memory-afk opened on Aug 25, 2026
  2

• [Bug] [Smart][serial/tty] board 阶段注册 tty 时 workqueue 未建导致挂死，所有 Smart+board 阶段注册串口的架构均受影响

  BSP: LoongsonBSPbugRT-Smart
  RT-Thread/rt-thread#11718 · Filter by author loongson-gz opened on Aug 18, 2026
  1

• [Bug] [Smart][tty] tty_wait_background 未守卫 td->lwp==NULL，finsh 首次 read(stdin) page fault

  BSP: LoongsonBSPbugRT-Smart
  RT-Thread/rt-thread#11717 · Filter by author loongson-gz opened on Aug 18, 2026
  2

• [Bug] [Smart][musl] 内核态调用 musl fopen 因 syscall 号位错配而失败，finsh 按键无反应

  BSP: LoongsonBSPbugRT-Smart
  RT-Thread/rt-thread#11716 · Filter by author loongson-gz opened on Aug 18, 2026
  3