CVE-2026-15892: mcumgr SMP Settings Memory Leak DOS Vulnerability

CVE-2026-15892 Overview

CVE-2026-15892 is a memory leak vulnerability [CWE-401] in the Zephyr RTOS mcumgr Simple Management Protocol (SMP) settings-management group. The handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c fail to free heap-allocated buffers when the application access hook rejects a request with MGMT_CB_ERROR_RC. An unauthenticated attacker reaching the SMP transport can send a sustained stream of rejected settings requests to exhaust the kernel heap, denying mcumgr service and impacting every other heap consumer on the device.

Critical Impact
Sustained rejected SMP settings requests monotonically drain the kernel heap until k_malloc() fails, forcing a reboot to restore service.

Affected Products

Zephyr RTOS builds enabling CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP
Zephyr RTOS builds enabling CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK with a hook returning MGMT_CB_ERROR_RC
Devices exposing mcumgr SMP over Bluetooth LE, UART, or UDP

Discovery Timeline

2026-09-13 - CVE-2026-15892 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-15892

Vulnerability Analysis

The mcumgr settings-management handlers allocate a key_name buffer, and for read operations an additional data buffer, using k_malloc() when CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is selected. Cleanup normally occurs through the end: label, which invokes k_free() on both allocations. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application-registered access hook returns MGMT_CB_ERROR_RC to reject a request, the handler executes return ret_rc; directly. This early return skips the end: label and leaks the heap allocation on every rejected request.

The leak is availability-only. There is no memory corruption and no information disclosure. The default stack buffer type is unaffected because no heap allocation occurs.

Root Cause

The root cause is missing cleanup on an error path [CWE-401]. The rejection branch bypasses the shared cleanup label rather than performing goto end;, leaving allocated buffers unreachable until reboot.

Attack Vector

The SMP transport is unauthenticated in typical configurations and reachable over Bluetooth LE, UART, or UDP depending on the product build. An attacker within reach of the transport sends settings read, write, or delete commands that the application access hook will reject. Each rejection leaks the key_name buffer, and read requests additionally leak the data buffer. Sustained requests exhaust the kernel heap, causing k_malloc() failures that starve mcumgr and any other heap consumer on the device.

 		if (status != MGMT_CB_OK) {
 			if (status == MGMT_CB_ERROR_RC) {
+#ifdef CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP
+				k_free(key_name);
+				k_free(data);
+#endif
 				return ret_rc;
 			}

Source: Zephyr GitHub Commit fabc488

Detection Methods for CVE-2026-15892

Indicators of Compromise

Repeated SMP settings-management requests (read, write, delete) from the same peer over Bluetooth LE, UART, or UDP.
mcumgr responses carrying MGMT_CB_ERROR_RC status codes at abnormal frequency.
Progressive k_malloc() failures and shrinking free heap reported by kernel heap statistics.

Detection Strategies

Instrument the application access hook to log and rate-count rejections per source and per settings key.
Enable CONFIG_SYS_HEAP_RUNTIME_STATS and periodically export free-heap metrics for anomaly baselining.
Correlate transport-layer connection events with sustained rejected-request patterns targeting the settings group.

Monitoring Recommendations

Alert on monotonic decline of free kernel heap between reboots on devices running mcumgr.
Monitor SMP command telemetry for burst patterns of settings requests originating from a single BLE peer or UDP source.
Track device uptime and unexpected reboots that follow heap-exhaustion events.

How to Mitigate CVE-2026-15892

Immediate Actions Required

Apply Zephyr commit fabc488d5b44143e5bd70dd373182c4395a816b9, which adds k_free(key_name) and k_free(data) on the MGMT_CB_ERROR_RC path.
Rebuild and reflash firmware for any device that enables both CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP and CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK.
Restrict SMP transport exposure by requiring pairing, bonding, or network-layer access controls where the transport supports it.

Patch Information

The fix is upstream in the Zephyr Project. See the Zephyr Security Advisory GHSA-rq68-wgv4-hcq3 and the remediation commit. The patch guards the added k_free() calls with #ifdef CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP so stack-buffer builds are unaffected.

Workarounds

Switch to the default stack buffer type by disabling CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP, which eliminates the heap allocation entirely.
Disable CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK if the deployment does not require application-level access control on settings.
Modify the application access hook to return MGMT_CB_OK with a permission response payload instead of MGMT_CB_ERROR_RC until the patch is deployed.

bash

# Disable heap buffer type in prj.conf to avoid the leak path
CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP=n
# Or disable the access hook if not required
CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK=n