What is the CVSS score of CVE-2026-10648?

CVE-2026-10648 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-10648?

Yes, a patch is available for CVE-2026-10648. Update the affected software to the latest version immediately.

Zephyr RTOS CVE-2026-10648

MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-29 zephyr

Denial Of Service Null Pointer Dereference Zephyr Zephyrproject

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (zephyr) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector confirmed by serial/UART/console-only attack path; PR:N because no authentication is enforced on the physical link itself; A:H for hard device fault; no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 01, 2026 - 14:07 NVD

6.2 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 29, 2026 - 23:31 vuln.today

DescriptionNVD

mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for NULL. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) against the shared MCUmgr packet pool (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, default 4), which returns NULL when the pool is exhausted. In default builds the __ASSERT_NO_MSG in net_buf_reset is a no-op, so net_buf_simple_reset writes through the NULL pointer (buf->len = 0; buf->data = buf->__buf), causing a fault/crash. The fragment data reaches this code from attacker-controlled bytes on the MCUmgr serial/UART/shell-console transports (smp_uart.c, smp_raw_uart.c, smp_shell.c), and a fresh buffer is allocated at the start of essentially every new packet. An attacker on the serial/console link can flood the transport to drive the 4-entry buffer pool to exhaustion and induce the NULL dereference, crashing the device (denial of service). The defect was introduced after the original MCUmgr rework and shipped in Zephyr v4.4.0. The fix moves the NULL check ahead of net_buf_reset.

AnalysisAI

Denial of service in Zephyr RTOS v4.4.0 allows an attacker with access to a serial, UART, or shell-console interface to crash an affected embedded device by exhausting the MCUmgr shared buffer pool and triggering a NULL pointer dereference. The defect in mcumgr_serial_process_frag() (CWE-476) was introduced during the MCUmgr rework and manifests in default builds where assertion checks are compiled out, making the write-through-NULL a hard fault rather than a caught assertion. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but exploitation is straightforward for any attacker with interface access.

Technical ContextAI

Zephyr RTOS (cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) is an open-source real-time operating system targeting resource-constrained embedded and IoT devices. Its MCUmgr subsystem provides a management protocol (SMP) over multiple transports including UART (smp_uart.c, smp_raw_uart.c) and shell-console (smp_shell.c). Each incoming SMP packet fragment triggers a buffer allocation from a shared kernel buffer pool sized by CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT (default 4). The root cause is CWE-476 (NULL Pointer Dereference): mcumgr_serial_process_frag() invokes net_buf_reset() on the pointer returned by smp_packet_alloc() without first checking whether the allocation succeeded. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT), which returns NULL immediately when the pool is exhausted rather than blocking. Because __ASSERT_NO_MSG is compiled out in default Zephyr builds, net_buf_simple_reset proceeds to write buf->len = 0 and buf->data = buf->__buf through the NULL pointer, causing a processor fault and device reset. The fix, available in upstream commit 6f363ec6, relocates the NULL guard ahead of the reset call.

RemediationAI

The upstream fix is available as commit 6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59 in the Zephyr project repository (https://github.com/zephyrproject-rtos/zephyr/commit/6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59); a patched tagged release version has not been independently confirmed from available data - project maintainers should monitor the Zephyr release channel for a version incorporating this fix. Developers building from source should cherry-pick or rebase to include the fix commit. As a compensating control, increasing CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT above the default of 4 raises the number of floods required to exhaust the pool, but does not eliminate the NULL dereference - it only makes the condition harder to trigger transiently. Disabling MCUmgr serial/UART/shell transport entirely (by removing CONFIG_MCUMGR_TRANSPORT_UART, CONFIG_MCUMGR_TRANSPORT_UDP_SMP, or CONFIG_MCUMGR_TRANSPORT_SHELL from the build configuration) is an effective workaround if the management interface is not required in production, with the trade-off of losing over-the-air firmware update and management capability. Physical access controls on serial/console ports reduce the attacker population but are not a software mitigation. The security advisory is at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j64f-h3ww-f32c.