The flaw is a NULL‑pointer dereference in the mcumgr_serial_process_frag function within Zephyr’s MCUmgr serial/console transport stack. When a packet is received, a buffer is allocated from a small shared pool; if the pool is exhausted the allocation returns NULL. The code then calls net_buf_reset on the NULL pointer, which causes a fault and crashes the device. The vulnerability arises when attacker‑controlled data is delivered over the serial/UART/shell‑console interfaces and floods the transport to exhaust the four‑entry buffer pool. The result is a predictable crash, providing a denial‑of‑service attack surface.

The defect affects the Zephyr project’s Zephyr RTOS in its default configuration. It was introduced after the MCUmgr rework and shipped in Zephyr version 4.4.0; any builds derived from that version using the default buffer‑pool size of four entries are vulnerable. The fix moves the NULL check ahead of net_buf_reset and is available in later releases that incorporate the change.

The CVSS score of 6.2 reflects a moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Nonetheless the attack vector is a local serial or console interface, which is often within reach of an attacker who can physically or remotely connect to the device. By sending a stream of packets the attacker can exhaust the limited buffer pool and trigger the crash, leading to denial of service. Because execution does not require additional privileges and the fault is deterministic, the risk to a device exposed to the serial console is significant when no mitigations are applied.