Denial of Service Vulnerability in Zephyr RTOS MCUmgr Component

CVE-2026-10648

What is CVE-2026-10648?

A vulnerability exists in the serial transport of the MCUmgr component of Zephyr RTOS, which may lead to a denial of service when exploited. The issue arises from the net_buf_reset function being called on a potentially NULL pointer, resulting from the exhaustion of the shared packet pool. An attacker can exploit this by flooding the transport layer, ultimately causing a device crash. This was introduced during the MCUmgr rework in the default build of Zephyr v4.4.0. A patch has been implemented to ensure the NULL check occurs before any reset is attempted, preventing this crash.

References