PT-2026-53755 · Zephyr · Zephyr

Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-10648

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zephyr version 4.4.0

Description An issue exists where the mcumgr serial process frag() function in subsys/mgmt/mcumgr/transport/src/serial util.c calls net buf reset() on the result of smp packet alloc() without first verifying if the result is NULL. The smp packet alloc() function utilizes net buf alloc(K NO WAIT) against a shared MCUmgr packet pool; when this pool is exhausted, it returns NULL. In default builds, this leads to a NULL pointer dereference during the net buf simple reset process, resulting in a system fault or crash. An attacker with access to the serial, UART, or shell-console transports can flood the transport to exhaust the buffer pool and induce a denial of service.

Recommendations Update Zephyr version 4.4.0 to a version where the NULL check is performed before calling net buf reset().

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-10648

Affected Products

Zephyr

References · 5

• https://github.com/zephyrproject-rtos/zephyr/commit/6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10648 · Security Note
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j64f-h3ww-f32c · Note
• https://twitter.com/infoflowcloud/status/2071736975346766077 · Twitter Post
• https://twitter.com/CVEnew/status/2071735279874932871 · Twitter Post