CVE-2026-10675 in Zephyr
Summary
by MITRE • 07/22/2026
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon).
A remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.
PB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact.
The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability exists within Zephyr's Bluetooth Mesh PB-ADV provisioning bearer implementation where the prov_msg_recv() function exhibits a critical timing flaw in its state management and watchdog timer handling. This issue stems from an improper sequence of operations that allows remote attackers to manipulate the provisioning protocol state machine through carefully crafted malicious packets on the BLE advertising channel. The vulnerability manifests when the provisioning protocol attempts to process incoming PB-ADV PDUs without proper validation order, creating a window where malformed or malicious data can influence the link state management.
The technical flaw specifically occurs due to the unconditional rescheduling of the provisioning protocol watchdog timer at the beginning of prov_msg_recv() function, prior to critical validation checks including FCS verification and ADV_LINK_INVALID status assessment. This design flaw creates a race condition where an attacker can exploit the timing gap between packet reception and state validation. When a provisioning attempt fails, the system correctly sets ADV_LINK_INVALID flag, but the subsequent processing of valid FCS packets on the same link ID continues to reset the timer even on invalidated links, preventing the normal timeout mechanism from functioning properly.
According to CWE-691, this vulnerability represents an inadequate control flow management where the system's response to invalid states is compromised by premature state modifications. The flaw aligns with ATT&CK technique T1499.004 (Endpoint Denial of Service) and specifically targets the provisioning service availability aspect of Bluetooth Mesh networks. The protocol timeout mechanism, designed as a safety net for link recovery, becomes ineffective due to this ordering issue, creating an attack surface where remote adversaries can maintain persistent invalid links through repeated packet injection.
The operational impact of this vulnerability extends beyond simple service disruption to create a persistent denial of provisioning service that affects the entire mesh network's ability to establish new connections or re-provision existing devices. Once exploited, the affected device remains in a permanently pinned state where its unprovisioned beacon is disabled and all subsequent Link Open requests are rejected, effectively rendering the device unusable within the mesh network until manual intervention occurs. The attack requires no authentication or prior trust relationship since PB-ADV PDUs are processed without authentication and FCS validation uses only keyless CRC mechanisms, making the attack surface particularly broad.
Security implications include complete service availability compromise for Bluetooth Mesh networks where devices become permanently unprovisionable, potentially affecting large-scale deployments of mesh networking solutions. The fix implemented in versions beyond v4.4.1 properly reorders the operations by moving the timer reschedule to occur after the ADV_LINK_INVALID check and FCS validation, ensuring that invalidated links cannot be revived through subsequent packet processing. This remediation addresses the root cause by implementing proper state validation before any timer modifications, preventing malicious actors from maintaining persistent invalid link states through repeated packet injection attacks while preserving legitimate provisioning functionality.
The vulnerability demonstrates a classic example of improper state machine handling in embedded security systems, where the sequence of operations directly impacts the system's ability to recover from error conditions. This flaw affects all Zephyr releases up to v4.4.1 and highlights the importance of proper timer management and state validation in real-time embedded systems where resource constraints and timing dependencies create unique attack vectors. The resolution ensures that once a link is marked as invalid, it cannot be resurrected through subsequent packet processing, maintaining system integrity and preventing denial of service conditions that could affect mission-critical mesh network deployments.