In Zephyr versions 4.4.0 through before 4.5.0, the function mcumgr_serial_process_frag() calls net_buf_reset() on a buffer allocated by smp_packet_alloc() without first checking if the allocation returned NULL. Since smp_packet_alloc() uses net_buf_alloc(K_NO_WAIT) on a limited shared MCUmgr packet pool (default size 4), exhaustion of this pool causes net_buf_alloc to return NULL. The subsequent net_buf_reset call writes through the NULL pointer, causing a fault and device crash. An attacker controlling input on MCUmgr serial/UART/shell-console transports can flood the buffer pool to trigger this denial of service. The defect was introduced after the original MCUmgr rework and fixed by moving the NULL check before net_buf_reset.

Successful exploitation results in a denial of service condition by crashing the affected device due to a NULL pointer dereference. There is no impact on confidentiality or integrity reported. The attack requires local access to the serial or console transport and can be performed without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves adding a NULL check before calling net_buf_reset to prevent the NULL pointer dereference. Until an official fix is available, limiting access to the MCUmgr serial/UART/shell-console transports or implementing rate limiting to prevent buffer pool exhaustion may reduce risk.