Executive brief
The mcumgr SMP settings-management group is a management interface used to configure device settings over wireless connections like Bluetooth LE or UART. When configured to use heap memory and an access control hook, rejected setting requests cause heap memory to leak without being freed. An attacker can repeatedly send denied requests to exhaust available memory, causing the device to become unable to process further management commands and potentially affecting other system functionality.
Technical details
The vulnerability is a memory leak in the settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() handler functions in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c. When CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is enabled, buffers are allocated via k_malloc() but only freed at an end: label. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application's access hook rejects a request by returning MGMT_CB_ERROR_RC, the handler calls return ret_rc directly without reaching the end: label, bypassing k_free() and leaking the heap allocation. The handlers are reachable over unauthenticated SMP transports (Bluetooth LE, UART, UDP depending on configuration). An attacker sending repeated rejected read/write/delete commands can monotonically exhaust the kernel heap, causing denial of service for mcumgr and other heap consumers. Only devices with both heap buffer type enabled and an access hook configured are affected; the default stack buffer type is not vulnerable.
Affected products
- Nordic Semiconductor NCS mcumgr affected versions prior to patch
Timeline
- 2026-09-13: disclosed: CVE-2026-15892 disclosed