In Zephyr, the function mcumgr_serial_process_frag in serial_util.c performs a net_buf_reset on a buffer returned by smp_packet_alloc before verifying that the allocation succeeded. smp_packet_alloc pulls a buffer from the shared MCUmgr packet pool (CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT, default 4) using net_buf_alloc(K_NO_WAIT). When the pool is exhausted smp_packet_alloc returns NULL. Because the default build treats the __ASSERT_NO_MSG in net_buf_reset as a no‑op, net_buf_simple_reset writes through the NULL pointer, setting buf->len to 0 and buf->data to buf->__buf, which causes a fault and crashes the device. The buffer is requested at the start of every new packet received over the MCUmgr serial/UART/shell-console transports. An attacker who can send packets over these interfaces can flood the transport, exhaust the four‑entry buffer pool, and trigger the NULL dereference, resulting in a denial‑of‑service crash.

Zephyr project’s Zephyr RTOS in its default configuration is affected. The vulnerability was introduced after the MCUmgr rework and shipped in Zephyr v4.4.0. Any builds derived from that version that use the default 4‑entry buffer pool are vulnerable. The issue is resolved in newer releases that incorporate the NULL check before resetting the buffer.

The CVSS score of 6.2 indicates moderate severity. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. The attack vector is a local serial or console interface, which may be accessible if the device is physically present or if the console is remote. By sending a stream of packets over the MCUmgr serial/UART/shell-console transports, an attacker can exhaust the pool and trigger the crash. No privilege escalation is required and the crash is deterministic, so the risk is significant for devices exposed to the serial console.