# CVE-2026-10648: Zephyr OS NULL pointer dereference in MCUmgr serial transport

Source: https://junglewise.ai/threats/cve-2026-10648-zephyr-os-null-pointer-dereference-in-mcumgr-serial-transport  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-10648 · Severity: medium · CVSS 6.2 · Published 2026-06-29

A vulnerability exists in the Zephyr real-time operating system's management component (MCUmgr), which handles device management over serial or console connections. An attacker with access to the serial or console port can send a flood of data to exhaust the device's internal memory buffers, causing the system to crash. This results in a denial-of-service, rendering the device unresponsive until it is manually reset.

Technologies: [Zephyr Project Zephyr](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-10648 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10648 being exploited in the wild.

**How severe is CVE-2026-10648?** Medium severity, with a CVSS score of 6.2, published 29 June 2026.

**Which products and versions are affected?** Zephyr Project Zephyr 4.4.0.

**Is there a fix for CVE-2026-10648?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10648 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-10648?** Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference exists in `mcumgr_serial_process_frag()` within `subsys/mgmt/mcumgr/transport/src/serial_util.c`. The function calls `net_buf_reset()` on the result of `smp_packet_alloc()` before verifying if the allocation succeeded. In production builds where assertions are disabled, `net_buf_reset()` proceeds to write to the NULL pointer when the shared MCUmgr packet pool (defaulting to 4 buffers) is exhausted. An attacker interacting with the MCUmgr serial, UART, or shell-console transports can flood the interface to trigger this exhaustion and crash the kernel. The issue was introduced in Zephyr v4.4.0 and is fixed in version 4.5.0 by reordering the NULL check before the buffer reset.

## Affected products

- Zephyr Project Zephyr OS 4.4.0

## Timeline

- 2026-06-26: other: Embargo date
- 2026-06-29: disclosed
- 2026-06-29: advisory

## References

- [https://github.com/zephyrproject-rtos/zephyr](https://github.com/zephyrproject-rtos/zephyr)
- [https://github.com/zephyrproject-rtos/zephyr/commit/6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59](https://github.com/zephyrproject-rtos/zephyr/commit/6f363ec6f7fd6ae9ed7ca2ae66fd9c82dce31c59)
- [https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j64f-h3ww-f32c](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j64f-h3ww-f32c)

## Related threats

- [Zephyr UART wide-data syscall verifier NULL pointer dereference](https://junglewise.ai/threats/cve-2026-90834-the-user-mode-syscall-verifiers-for-the-16-bit-wide-data-uart-api)
- [Zephyr PTP port unvalidated logMessageInterval denial of service](https://junglewise.ai/threats/cve-2026-87042-the-ieee-1588-ptp-port-implementation-in-subsys-net-lib-ptp-port)
- [Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection)
- [Zephyr OpenThread hardcoded default joiner credential](https://junglewise.ai/threats/cve-2026-19741-zephyr-s-openthread-integration-defined-config-openthread-joiner)
- [Zephyr ARM64 MMU ASID allocation collision in memory domain isolation](https://junglewise.ai/threats/cve-2026-19574-the-arm64-mmu-back-end-allocated-address-space-identifiers-asids)