CVE-2026-10648

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10648", "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "state": "PUBLISHED", "assignerShortName": "zephyr", "dateReserved": "2026-06-02T15:11:51.742Z", "datePublished": "2026-06-29T22:51:27.935Z", "dateUpdated": "2026-11-04T04:58:24.159Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "shortName": "zephyr", "dateUpdated": "2026-11-04T04:58:24.159Z"}, "title": "NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion", "descriptions": [{"lang": "en", "value": "mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for NULL. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) against the shared MCUmgr packet pool (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, default 4), which returns NULL when the pool is exhausted. In default builds the __ASSERT_NO_MSG in net_buf_reset is a no-op, so net_buf_simple_reset writes through the NULL pointer (buf->len = 0; buf->data = buf->__buf), causing a fault/crash.\n\nThe fragment data reaches this code from attacker-controlled bytes on the MCUmgr serial/UART/shell-console transports (smp_uart.c, smp_raw_uart.c, smp_shell.c), and a fresh buffer is allocated at the start of essentially every new packet. An attacker on the serial/console link can flood the transport to drive the 4-entry buffer pool to exhaustion and induce the NULL dereference, crashing the device (denial of service).\n\nThe defect was introduced after the original MCUmgr rework and shipped in Zephyr v4.4.0. The fix moves the NULL check ahead of net_buf_reset."}], "affected": [{"vendor": "zephyrproject", "product": "zephyr", "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "packageName": "zephyr", "defaultStatus": "unaffected", "programFiles": ["subsys/mgmt/mcumgr/transport/src/serial_util.c"], "versions": [{"version": "4.4.0", "status": "affected", "versionType": "semver", "lessThan": "4.4.1"}]}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59", "name": "Fix commit", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j64f-h3ww-f32c", "name": "GHSA-j64f-h3ww-f32c"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "memory-safety", "cweId": "CWE-476", "type": "CWE"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-30T13:12:36.467942Z", "id": "CVE-2026-10648", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T13:12:45.168Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10648", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-30T13:12:36.467942Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T13:12:41.855Z"}}], "cna": {"title": "NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "4.4.0", "lessThan": "4.4.1", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["subsys/mgmt/mcumgr/transport/src/serial_util.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59", "name": "Fix commit", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j64f-h3ww-f32c", "name": "GHSA-j64f-h3ww-f32c"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for NULL. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) against the shared MCUmgr packet pool (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, default 4), which returns NULL when the pool is exhausted. In default builds the __ASSERT_NO_MSG in net_buf_reset is a no-op, so net_buf_simple_reset writes through the NULL pointer (buf->len = 0; buf->data = buf->__buf), causing a fault/crash.\n\nThe fragment data reaches this code from attacker-controlled bytes on the MCUmgr serial/UART/shell-console transports (smp_uart.c, smp_raw_uart.c, smp_shell.c), and a fresh buffer is allocated at the start of essentially every new packet. An attacker on the serial/console link can flood the transport to drive the 4-entry buffer pool to exhaustion and induce the NULL dereference, crashing the device (denial of service).\n\nThe defect was introduced after the original MCUmgr rework and shipped in Zephyr v4.4.0. The fix moves the NULL check ahead of net_buf_reset."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "memory-safety"}]}], "providerMetadata": {"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "shortName": "zephyr", "dateUpdated": "2026-11-04T04:58:24.159Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10648", "state": "PUBLISHED", "dateUpdated": "2026-11-04T04:58:24.159Z", "dateReserved": "2026-06-02T15:11:51.742Z", "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "datePublished": "2026-06-29T22:51:27.935Z", "assignerShortName": "zephyr"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected", "packageName": "zephyr", "product": "zephyr", "programFiles": ["subsys/mgmt/mcumgr/transport/src/serial_util.c"], "vendor": "zephyrproject", "versions": [{"lessThan": "4.4.1", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "vulnerabilities@zephyrproject.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:-:*:*:*:*:*:*", "matchCriteriaId": "4CA6A348-BF30-436F-8C97-DC2AC4B276F9", "vulnerable": true}, {"criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "751E0B4E-7D5E-4847-ADD2-0A04D95A0577", "vulnerable": true}, {"criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "CF3B04E2-F95F-42DD-BA7E-E96D4965E1D3", "vulnerable": true}, {"criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "15D1A475-CDAB-486F-82C6-E885E844DA22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for NULL. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) against the shared MCUmgr packet pool (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, default 4), which returns NULL when the pool is exhausted. In default builds the __ASSERT_NO_MSG in net_buf_reset is a no-op, so net_buf_simple_reset writes through the NULL pointer (buf->len = 0; buf->data = buf->__buf), causing a fault/crash.\n\nThe fragment data reaches this code from attacker-controlled bytes on the MCUmgr serial/UART/shell-console transports (smp_uart.c, smp_raw_uart.c, smp_shell.c), and a fresh buffer is allocated at the start of essentially every new packet. An attacker on the serial/console link can flood the transport to drive the 4-entry buffer pool to exhaustion and induce the NULL dereference, crashing the device (denial of service).\n\nThe defect was introduced after the original MCUmgr rework and shipped in Zephyr v4.4.0. The fix moves the NULL check ahead of net_buf_reset."}, {"lang": "es", "value": "\u201cmcumgr_serial_process_frag()\u201d en \u201csubsys/mgmt/mcumgr/transport/src/serial_util.c\u201d llama a \u201cnet_buf_reset()\u201d sobre el resultado de \u201csmp_packet_alloc()\u201d antes de comprobar si es \u201cNULL\u201d. \u201csmp_packet_alloc()\u201d utiliza \u201cnet_buf_alloc(K_NO_WAIT)\u201d contra el pool de paquetes compartido de MCUmgr (\u201cCONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT\u201d, por defecto 4), el cual devuelve \u201cNULL\u201d cuando el pool est\u00e1 agotado. En las compilaciones por defecto, el \u201c__ASSERT_NO_MSG\u201d en \u201cnet_buf_reset\u201d es una operaci\u00f3n nula, por lo que \u201cnet_buf_simple_reset\u201d escribe a trav\u00e9s del puntero \u201cNULL\u201d (\u201cbuf -> len = 0; buf -> data = buf -> __buf\u201d), causando un fallo/cierre inesperado. Los datos del fragmento llegan a este c\u00f3digo desde bytes controlados por el atacante en los transportes serial/UART/shell-console de MCUmgr (\u201csmp_uart.c\u201d, \u201csmp_raw_uart.c\u201d, \u201csmp_shell.c\u201d), y se asigna un nuevo b\u00fafer al inicio de esencialmente cada nuevo paquete. Un atacante en el enlace serial/consola puede inundar el transporte para llevar el pool de b\u00faferes de 4 entradas al agotamiento e inducir la desreferencia \u201cNULL\u201d, bloqueando el dispositivo (denegaci\u00f3n de servicio). El defecto fue introducido despu\u00e9s de la reelaboraci\u00f3n original de MCUmgr y se envi\u00f3 en Zephyr v4.4.0. La soluci\u00f3n mueve la comprobaci\u00f3n de \u201cNULL\u201d antes de \u201cnet_buf_reset\u201d."}], "id": "CVE-2026-10648", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "vulnerabilities@zephyrproject.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10648", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-30T13:12:36.467942Z", "version": "2.0.3"}}]}, "published": "2026-06-29T23:16:42.180", "references": [{"source": "vulnerabilities@zephyrproject.org", "tags": ["Patch"], "url": "https://github.com/zephyrproject-rtos/zephyr/commit/6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59"}, {"source": "vulnerabilities@zephyrproject.org", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j64f-h3ww-f32c"}], "sourceIdentifier": "vulnerabilities@zephyrproject.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "vulnerabilities@zephyrproject.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "zephyr", "source": "cna", "vendor": "zephyrproject"}, "product": "zephyr", "vendor": "zephyrproject"}], "created": "2026-06-30T00:30:06.461743+00:00", "updated": "2026-07-31T16:45:03.774862+00:00", "vendors": ["zephyrproject", "zephyrproject$PRODUCT$zephyr"]}