CVE-2026-10648

{
  "id": "CVE-2026-10648",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-29T23:16:42.180",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for NULL. smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) against the shared MCUmgr packet pool (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, default 4), which returns NULL when the pool is exhausted. In default builds the __ASSERT_NO_MSG in net_buf_reset is a no-op, so net_buf_simple_reset writes through the NULL pointer (buf->len = 0; buf->data = buf->__buf), causing a fault/crash.\n\nThe fragment data reaches this code from attacker-controlled bytes on the MCUmgr serial/UART/shell-console transports (smp_uart.c, smp_raw_uart.c, smp_shell.c), and a fresh buffer is allocated at the start of essentially every new packet. An attacker on the serial/console link can flood the transport to drive the 4-entry buffer pool to exhaustion and induce the NULL dereference, crashing the device (denial of service).\n\nThe defect was introduced after the original MCUmgr rework and shipped in Zephyr v4.4.0. The fix moves the NULL check ahead of net_buf_reset."
    },
    {
      "lang": "es",
      "value": "“mcumgr_serial_process_frag()” en “subsys/mgmt/mcumgr/transport/src/serial_util.c” llama a “net_buf_reset()” sobre el resultado de “smp_packet_alloc()” antes de comprobar si es “NULL”. “smp_packet_alloc()” utiliza “net_buf_alloc(K_NO_WAIT)” contra el pool de paquetes compartido de MCUmgr (“CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT”, por defecto 4), el cual devuelve “NULL” cuando el pool está agotado. En las compilaciones por defecto, el “__ASSERT_NO_MSG” en “net_buf_reset” es una operación nula, por lo que “net_buf_simple_reset” escribe a través del puntero “NULL” (“buf  ->  len = 0; buf  ->  data = buf  ->  __buf”), causando un fallo/cierre inesperado. Los datos del fragmento llegan a este código desde bytes controlados por el atacante en los transportes serial/UART/shell-console de MCUmgr (“smp_uart.c”, “smp_raw_uart.c”, “smp_shell.c”), y se asigna un nuevo búfer al inicio de esencialmente cada nuevo paquete. Un atacante en el enlace serial/consola puede inundar el transporte para llevar el pool de búferes de 4 entradas al agotamiento e inducir la desreferencia “NULL”, bloqueando el dispositivo (denegación de servicio). El defecto fue introducido después de la reelaboración original de MCUmgr y se envió en Zephyr v4.4.0. La solución mueve la comprobación de “NULL” antes de “net_buf_reset”."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/mgmt/mcumgr/transport/src/serial_util.c"
          ],
          "versions": [
            {
              "version": "4.4.0",
              "lessThan": "4.4.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-30T13:12:36.467942Z",
          "id": "CVE-2026-10648",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "4CA6A348-BF30-436F-8C97-DC2AC4B276F9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "751E0B4E-7D5E-4847-ADD2-0A04D95A0577"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "CF3B04E2-F95F-42DD-BA7E-E96D4965E1D3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "15D1A475-CDAB-486F-82C6-E885E844DA22"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j64f-h3ww-f32c",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}