In Zephyr v4.4.0, the mcumgr_serial_process_frag() function in the MCUmgr serial transport calls net_buf_reset() on the result of smp_packet_alloc() without verifying if the allocation returned NULL. Since smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) on a limited shared buffer pool (default size 4), exhaustion of this pool causes net_buf_alloc() to return NULL. net_buf_reset() then writes through this NULL pointer, causing a crash. An attacker controlling the serial/UART/shell-console input can flood the transport to exhaust the buffer pool and trigger this NULL dereference, resulting in denial of service. The vulnerability was introduced after the original MCUmgr rework and shipped in Zephyr 4.4.0. The fix involves adding a NULL check before calling net_buf_reset().

This vulnerability allows an attacker with access to the MCUmgr serial or console transport to cause a denial of service by crashing the device through a NULL pointer dereference. There is no impact on confidentiality or integrity, but availability is affected due to the forced crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described moves the NULL check ahead of net_buf_reset() to prevent the NULL pointer dereference. Until an official patch or update is available, restrict access to the MCUmgr serial/UART/shell-console interfaces to trusted users to prevent exploitation.