ZephyrProject Zephyr up to 4.4.x Bluetooth Mesh pb_adv.c prov_msg_recv state issue

Summaryinfo

A vulnerability was found in ZephyrProject Zephyr up to 4.4.x. It has been declared as critical. Impacted is the function prov_msg_recv of the file subsys/bluetooth/mesh/pb_adv.c of the component Bluetooth Mesh. Executing a manipulation can lead to state issue. This vulnerability is registered as CVE-2026-10675. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability has been found in ZephyrProject Zephyr up to 4.4.x and classified as critical. This vulnerability affects the function prov_msg_recv of the file subsys/bluetooth/mesh/pb_adv.c of the component Bluetooth Mesh. The manipulation with an unknown input leads to a state issue vulnerability. The CWE definition for the vulnerability is CWE-371. As an impact it is known to affect availability. CVE summarizes:

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon). A remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected. PB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact. The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-10675 since 06/02/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 4.5.0 eliminates this vulnerability. Applying the patch 3f3c37edf80262b838ef5402fec9880c07892e4e is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion