Zephyr RTOS CVE-2026-10648

Exploitation requires the attacker to have access to the MCUmgr serial, UART, or shell-console transport link on the target device - specifically, one of the three affected transport drivers (smp_uart.c, smp_raw_uart.c, or smp_shell.c) must be compiled into the firmware. The device must run Zephyr v4.4.0 with MCUmgr serial transport enabled, which is a non-default feature that must be explicitly included in the board or application configuration. The default buffer pool size of 4 (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT) makes exhaustion trivially achievable. Exploitation is limited by: the requirement for physical or local access to the serial/UART/console interface (CVSS AV:L), the need for MCUmgr transport to be enabled in the specific firmware build, and restriction to Zephyr v4.4.0 builds prior to the fix commit. No network-based exploitation path exists; an attacker must be physically present or have shell-level access to the host connected to the device's console port.

The CVSS 3.1 base score of 6.2 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the constrained attack surface: exploitation requires physical or logical presence on the serial or shell-console link, which substantially limits the attacker population compared to network-reachable vulnerabilities. Attack complexity is genuinely low once the interface is accessible - flooding with SMP packets until the 4-entry pool is exhausted is trivial. The Availability:High rating is warranted because the result is a hard device fault and reset, not a graceful degradation. There is no confidentiality or integrity impact. No EPSS data was provided in the intelligence set, and the vulnerability carries no CISA KEV listing and no known public POC. The primary real-world risk is physical-access adversaries or insider threats targeting embedded/IoT devices running MCUmgr-enabled Zephyr v4.4.0. The extremely small buffer pool (4 entries) means the denial-of-service condition is reliably reproducible without sophisticated tooling. For devices in safety-critical or always-available roles (industrial controls, medical devices), the crash impact may exceed what the medium CVSS score implies.

An attacker with physical or logical access to a UART or shell-console port on a Zephyr v4.4.0 device rapidly sends a stream of MCUmgr SMP packet fragments, driving all four entries in the shared MCUmgr buffer pool to allocated-but-not-freed state. The next fragment allocation returns NULL, mcumgr_serial_process_frag() calls net_buf_reset() on it without checking, and the resulting NULL pointer write causes a processor exception, crashing and resetting the device. No exploit code has been publicly identified, but the attack requires only a serial terminal and knowledge of the SMP packet format.