The mcumgr SMP settings-management group handlers settingsmgmtread(), settingsmgmtwrite(), and settingsmgmtdelete() in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer (and, for read, a data buffer) via kmalloc() when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying on the end: label to kfree() them. When CONFIGMCUMGRGRPSETTINGSACCESSHOOK is also enabled and the application access hook rejects a request by returning status MGMTCBERRORRC, the handler executed return retrc; directly, bypassing end: and leaking the heap allocation on every rejected request.

The settings handlers are reachable over the unauthenticated SMP transport (Bluetooth LE, UART, or UDP, depending on product configuration). The access hook is the mechanism applications use to deny unauthorized settings access, and MGMTCBERRORRC is a common rejection style, so an attacker who can send settings read/write/delete commands that the hook rejects triggers a heap leak on each attempt.

Because the leaked memory is never reclaimed until reboot, a sustained stream of rejected requests monotonically exhausts the kernel heap until kmalloc() fails, denying mcumgr service and impacting any other heap consumer on the device — a denial of service. The impact is availability-only; there is no memory corruption or information disclosure. Only configurations that select the heap buffer type, enable the access hook, and register a hook that returns MGMTCBERRORRC are affected (the default stack buffer type cannot leak).