Heap Memory Leak in mcumgr Settings Management for Zephyr RTOS

CVE-2026-15892

What is CVE-2026-15892?

The mcumgr settings-management group in the Zephyr RTOS can experience a heap memory leak due to improper handling of rejected settings requests. When certain configuration flags are enabled, the settings management functions allocate memory without appropriate cleanup when access is denied. This leads to a potential denial of service as the heap fills up with unreleased allocations from repeated rejected commands, impacting the overall availability of the mcumgr service and other components that rely on the kernel heap.

References