CVE-2026-10648 zephyrproject CVE debrief

Who should care

Zephyr users, developers, and administrators should assess exposure and prioritize verification of affected versions, inventory checks, and compensating controls to prevent exploitation.

Why it matters

CVE-2026-10648 is a medium-severity vulnerability in Zephyr's MCUmgr serial/console SMP transport. An attacker on the serial/console link can exploit it to crash the device, resulting in a denial of service. Zephyr users should assess exposure, verify affected versions, and prioritize remediation and compensating controls.

• Denial of service (crash) on affected Zephyr devices
• Potential for exploitation requires verification from official sources
• Remediation priority for Zephyr versions 4.4.0 and prior
• Verification of inventory and compensating controls recommended

Technical summary

The `mcumgr_serial_process_frag` function in Zephyr's MCUmgr serial/console SMP transport does not check for NULL before calling `net_buf_reset` on the result of `smp_packet_alloc`. When the shared MCUmgr packet pool is exhausted due to a flood of attacker-controlled bytes on the MCUmgr serial/UART/shell-console transports, `smp_packet_alloc` returns NULL, leading to a NULL-pointer dereference and a crash. This vulnerability can be exploited by an attacker on the serial/console link to cause a denial of service. The issue was introduced after the original MCUmgr rework and shipped in Zephyr v4.4.0. The fix moves the NULL check ahead of `net_buf_reset`.

Defensive priority

Zephyr users should assess exposure and prioritize verification of affected versions, inventory checks, and compensating controls.

Recommended defensive actions

• Verify Zephyr version and assess exposure
• Implement inventory checks for affected versions
• Monitor for suspicious activity on serial/console links
• Apply compensating controls to prevent exploitation
• Review vendor guidance for patching or mitigation
• Conduct asset inventory to identify potentially affected systems
• Track and verify remediation of exposed assets

Evidence notes

The CVE record and source item provide details on the vulnerability, including its cause, impact, and affected versions. However, the corpus does not establish versions beyond 4.4.0, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.