CVE-2026-15892

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15892
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15892.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15892
Aliases
  • GHSA-rq68-wgv4-hcq3
Published
2026-09-13T22:46:16Z
Modified
2026-09-15T08:04:32Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service
Details

The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c allocate a key_name buffer (and, for read, a data buffer) via k_malloc() when CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is enabled, relying on the end: label to k_free() them. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application access hook rejects a request by returning status MGMT_CB_ERROR_RC, the handler executed return ret_rc; directly, bypassing end: and leaking the heap allocation on every rejected request.

The settings handlers are reachable over the unauthenticated SMP transport (Bluetooth LE, UART, or UDP, depending on product configuration). The access hook is the mechanism applications use to deny unauthorized settings access, and MGMT_CB_ERROR_RC is a common rejection style, so an attacker who can send settings read/write/delete commands that the hook rejects triggers a heap leak on each attempt.

Because the leaked memory is never reclaimed until reboot, a sustained stream of rejected requests monotonically exhausts the kernel heap until k_malloc() fails, denying mcumgr service and impacting any other heap consumer on the device — a denial of service. The impact is availability-only; there is no memory corruption or information disclosure. Only configurations that select the heap buffer type, enable the access hook, and register a hook that returns MGMT_CB_ERROR_RC are affected (the default stack buffer type cannot leak).

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-401"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15892.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
a6eef0ba3755f2530c5ce93524e5ac4f5be30194
Fixed
fabc488d5b44143e5bd70dd373182c4395a816b9
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.5.0
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3
zephyr-v3.*
zephyr-v3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15892.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "109694120658945460627292267733448007525",
            "length": 2419
        },
        "id": "CVE-2026-15892-24273730",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/fabc488d5b44143e5bd70dd373182c4395a816b9",
        "target": {
            "file": "subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c",
            "function": "settings_mgmt_read"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "90521599438798616212095345602082349032",
            "length": 1918
        },
        "id": "CVE-2026-15892-9a16b8e1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/fabc488d5b44143e5bd70dd373182c4395a816b9",
        "target": {
            "file": "subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c",
            "function": "settings_mgmt_write"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "229225792698604563743049013866278547844",
                "339564681585841441777497126200136848838",
                "187378090209599131892207849636169407866",
                "194529243150926284265042934358246615259",
                "229225792698604563743049013866278547844",
                "339564681585841441777497126200136848838",
                "187378090209599131892207849636169407866",
                "194529243150926284265042934358246615259",
                "229225792698604563743049013866278547844",
                "339564681585841441777497126200136848838",
                "187378090209599131892207849636169407866",
                "194529243150926284265042934358246615259"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-15892-abfe524a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/fabc488d5b44143e5bd70dd373182c4395a816b9",
        "target": {
            "file": "subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "58099849202569967668423214064863586721",
            "length": 1774
        },
        "id": "CVE-2026-15892-d06971eb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/fabc488d5b44143e5bd70dd373182c4395a816b9",
        "target": {
            "file": "subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c",
            "function": "settings_mgmt_delete"
        }
    }
]
vanir_signatures_modified 
"2026-09-15T08:04:32Z"