CVE-2026-10675

Received Received - Intake

Bluetooth Mesh PB-ADV Provisioning Denial of Service

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Zephyr Project

Description

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon). A remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected. PB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact. The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-10675

Affected Vendors & Products

Vendor	Product	Version / Range
zephyr_project	zephyr	to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is in Zephyr's Bluetooth Mesh PB-ADV provisioning bearer. The issue occurs in the prov_msg_recv() function, which unconditionally resets a watchdog timer before performing critical checks like FCS validation and ADV_LINK_INVALID verification. An attacker can exploit this by sending a malformed PDU to trigger a provisioning failure, then repeatedly sending valid PB-ADV packets to reset the timer. This keeps the device in an unprovisionable state indefinitely, blocking new provisioning attempts.

Detection Guidance

This vulnerability affects Zephyr's Bluetooth Mesh PB-ADV provisioning bearer. Detection requires checking if devices remain in an unprovisionable state with disabled beacons after provisioning attempts. Monitor for devices failing to enter provisioning mode or rejecting new Link Open requests. No specific commands are provided in the context.

Impact Analysis

The impact is a persistent denial of service for Bluetooth Mesh device provisioning or re-provisioning. Affected devices remain in an unprovisionable state with their unprovisioned beacon disabled, preventing legitimate users from adding or updating devices on the network. No confidentiality or integrity issues occur, but availability is compromised.

Mitigation Strategies

Update Zephyr to a version beyond v4.4.1 where the fix has been applied. The fix moves the timer reschedule after the ADV_LINK_INVALID check to prevent invalid links from being kept alive. If updating is not immediately possible, restrict access to the BLE advertising channel to trusted devices.

Hi! I’m here to help you understand CVE-2026-10675. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70