Executive Summary

CVE-2026-5589 is an out-of-bounds write vulnerability caused by an integer underflow in the Bluetooth Mesh solicitation handling function bt_mesh_sol_recv() in the Zephyr RTOS. When the CONFIG_BT_MESH_OD_PRIV_PROXY_SRV configuration is enabled, the function parses BLE advertisement payloads and reads an attacker-controlled length byte called reported_len. If reported_len is less than 3, subtracting 3 results in a negative value that bypasses length checks and is implicitly converted to a very large unsigned integer. This causes the buffer pointer to advance far beyond its valid range, leading to out-of-bounds memory access.

In builds without assertions, this results in the buffer length wrapping around and the data pointer moving approximately 4GB forward, pointing to invalid memory. Subsequent reads from this invalid memory can cause arbitrary code execution or denial of service. The vulnerability can be triggered by a nearby BLE device sending a crafted non-connectable advertisement with a UUID16 AD structure and a malicious length byte, without requiring pairing or prior association.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to serious security impacts including denial of service (DoS) and arbitrary code execution on devices running vulnerable versions of the Zephyr RTOS Bluetooth Mesh subsystem.

• Denial of Service: The out-of-bounds write can cause the system to crash or become unresponsive.
• Arbitrary Code Execution: An attacker can exploit the invalid memory access to execute malicious code remotely.
• No pairing or prior association is required, so any nearby BLE device can trigger the vulnerability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered by a nearby BLE device sending a non-connectable advertisement with a crafted UUID16 AD structure and a malicious length byte. Detection involves monitoring Bluetooth Low Energy (BLE) advertising packets for abnormal or malformed AD structures, especially those with length bytes less than 3 in solicitation PDUs.

You can use BLE scanning tools to capture and analyze advertising packets. For example, using Linux's 'hcitool' or 'bluetoothctl' to scan BLE devices, or more advanced tools like 'btmon' or 'Wireshark' with BLE capture capabilities, to inspect the raw advertising payloads for suspicious length fields.

• Use 'sudo btmon' to monitor BLE traffic and look for UUID16 AD structures with length fields less than 3.
• Use 'sudo hcitool lescan' to discover nearby BLE devices and then 'sudo hcidump --raw' or 'sudo hcidump --raw -i hciX' (replace hciX with your interface) to capture raw advertising data for analysis.
• Analyze captured BLE advertising packets in Wireshark, filtering for Bluetooth Low Energy advertising PDUs and inspecting the AD length fields for values less than 3.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves disabling the CONFIG_BT_MESH_OD_PRIV_PROXY_SRV configuration option in Zephyr builds if it is enabled, as this feature is directly involved in the vulnerability.

Additionally, restrict or monitor BLE advertising traffic from untrusted or unknown devices to prevent malicious advertisements from reaching vulnerable systems.

Since no patched versions are currently available, consider applying custom patches or workarounds to add proper bounds checking on the reported_len field in the bt_mesh_sol_recv() function to prevent integer underflow.

Ensure that assertions (CONFIG_ASSERT) are enabled in builds to help catch such issues during development and testing.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0