CVE-2026-15892

Received Received - Intake

Heap Leak in mcumgr Settings Handlers via Access Hook

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: Zephyr Project

Description

The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c allocate a key_name buffer (and, for read, a data buffer) via k_malloc() when CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is enabled, relying on the end: label to k_free() them. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application access hook rejects a request by returning status MGMT_CB_ERROR_RC, the handler executed return ret_rc; directly, bypassing end: and leaking the heap allocation on every rejected request. The settings handlers are reachable over the unauthenticated SMP transport (Bluetooth LE, UART, or UDP, depending on product configuration). The access hook is the mechanism applications use to deny unauthorized settings access, and MGMT_CB_ERROR_RC is a common rejection style, so an attacker who can send settings read/write/delete commands that the hook rejects triggers a heap leak on each attempt. Because the leaked memory is never reclaimed until reboot, a sustained stream of rejected requests monotonically exhausts the kernel heap until k_malloc() fails, denying mcumgr service and impacting any other heap consumer on the device — a denial of service. The impact is availability-only; there is no memory corruption or information disclosure. Only configurations that select the heap buffer type, enable the access hook, and register a hook that returns MGMT_CB_ERROR_RC are affected (the default stack buffer type cannot leak).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-15892

Affected Vendors & Products

Vendor	Product	Version / Range
zephyr_project	mcumgr	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap memory leak in the mcumgr SMP settings-management group handlers. When certain configurations are enabled, rejected settings requests cause heap allocations to leak because the cleanup code is bypassed. A sustained attack can exhaust kernel heap memory, leading to a denial of service.

Detection Guidance

This vulnerability can be detected by monitoring heap memory usage on devices running affected configurations. Check for increasing heap exhaustion during sustained settings read/write/delete requests via unauthenticated SMP transports like Bluetooth LE, UART, or UDP. Use system monitoring tools to track memory allocation failures or mcumgr service disruptions.

Impact Analysis

An attacker can send repeated settings read/write/delete commands that get rejected, causing heap memory to leak until the system runs out of memory. This disrupts mcumgr service and may affect other parts of the device relying on the heap, resulting in a denial of service.

Mitigation Strategies

Disable CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP and use the default stack buffer type instead. Ensure the access hook does not return MGMT_CB_ERROR_RC for rejected requests. Alternatively, disable CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK if not needed. Apply patches from the Zephyr project if available.

Hi! I’m here to help you understand CVE-2026-15892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70