CVE-2026-10675: Zephyr Bluetooth Mesh DoS Vulnerability

CVE-2026-10675 Overview

CVE-2026-10675 is a denial-of-service vulnerability in the Zephyr RTOS Bluetooth Mesh PB-ADV provisioning bearer implemented in subsys/bluetooth/mesh/pb_adv.c. The prov_msg_recv() function rescheduled the provisioning protocol watchdog timer before validating the Frame Check Sequence (FCS) and the ADV_LINK_INVALID state. A remote, unauthenticated attacker within Bluetooth Low Energy (BLE) range can keep an invalidated provisioning link alive indefinitely, preventing the device from being provisioned or re-provisioned. The flaw is tracked as [CWE-400] Uncontrolled Resource Consumption and affects Zephyr releases up to and including v4.4.1.

Critical Impact
Attackers within BLE advertising range can persistently disable Bluetooth Mesh provisioning on affected Zephyr devices, blocking legitimate onboarding without any pairing or prior trust.

Affected Products

Zephyr RTOS Bluetooth Mesh subsystem (subsys/bluetooth/mesh/pb_adv.c)
Zephyr releases through v4.4.1
Bluetooth Mesh unprovisioned devices using PB-ADV bearer

Discovery Timeline

2026-07-21 - CVE-2026-10675 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-10675

Vulnerability Analysis

The PB-ADV bearer transports Bluetooth Mesh provisioning PDUs over BLE advertising channels. The prov_msg_recv() function processes incoming transaction PDUs on an established provisioning link. In vulnerable releases, the function called k_work_reschedule(&link.prot_timer, ...) unconditionally at the top of the function, before checking the FCS and before checking whether the link had been invalidated by a prior failure.

After a provisioning attempt fails, prov_failed() sets the ADV_LINK_INVALID flag. The only recovery path is the protocol timeout firing, which calls protocol_timeout -> prov_link_close -> close_link -> reset_adv_link. That teardown re-enables scanning and the unprovisioned device beacon so a new Link Open can succeed.

Because the timer was rescheduled before validity checks, any FCS-valid PB-ADV transaction PDU sent on the same link ID reset the watchdog even when the link was already invalidated. Sending such a packet more often than once per protocol timeout window keeps the dead link pinned. The device stays in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.

Root Cause

The root cause is incorrect ordering of state validation and timer management. The watchdog timer intended to tear down a broken link was refreshed by packets that should have been rejected. PB-ADV PDUs are processed without authentication, and the FCS is a keyless CRC, so an attacker chooses the link ID and can craft valid frames without pairing.

Attack Vector

An adjacent-network attacker on BLE first induces a provisioning failure using a malformed generic-provisioning PDU. The attacker then transmits any FCS-valid PB-ADV transaction PDU on the same link ID at intervals shorter than the protocol timeout, which is 60 seconds by default or 120 seconds when OOB input/output is used. Each transmission resets the timer and prevents link teardown.

// Patch: subsys/bluetooth/mesh/pb_adv.c
static void prov_msg_recv(void)
{
-	k_work_reschedule(&link.prot_timer, bt_mesh_prov_protocol_timeout_get());
-
 	if (!bt_mesh_fcs_check(link.rx.buf, link.rx.fcs)) {
 		LOG_ERR("Incorrect FCS");
 		return;

Source: Zephyr commit 3f3c37edf80262b838ef5402fec9880c07892e4e. The fix defers the timer reschedule until after the FCS check and the ADV_LINK_INVALID check, so packets on an invalidated link can no longer keep it alive.

Detection Methods for CVE-2026-10675

Indicators of Compromise

Repeated PB-ADV transaction PDUs targeting the same link ID following a provisioning failure event.
Zephyr log entries containing Incorrect FCS or prov_failed immediately followed by continued PB-ADV traffic on the same link.
Bluetooth Mesh devices remaining silent on the unprovisioned beacon channel for extended periods despite not being provisioned.

Detection Strategies

Instrument BLE sniffers to correlate PB-ADV transaction PDUs by link ID and flag links that outlive a provisioning failure.
Monitor Zephyr device logs for absence of protocol_timeout firings after prov_failed on an active link.
Baseline the frequency of unprovisioned device beacons; sustained suppression is a strong signal of link pinning.

Monitoring Recommendations

Deploy BLE spectrum monitoring around Mesh deployments to identify anomalous PB-ADV traffic patterns from unknown sources.
Alert on provisioning workflows that fail to complete within expected windows on managed Zephyr fleets.
Track firmware version inventories to identify devices still running Zephyr builds up to v4.4.1.

How to Mitigate CVE-2026-10675

Immediate Actions Required

Inventory all Zephyr-based devices using Bluetooth Mesh and identify those running versions up to v4.4.1.
Apply the upstream patch from commit 3f3c37e in subsys/bluetooth/mesh/pb_adv.c and rebuild affected firmware.
Prioritize deployment for devices provisioned in physically accessible or public RF environments.

Patch Information

The fix is available in the Zephyr project via commit 3f3c37edf80262b838ef5402fec9880c07892e4e and documented in GitHub Security Advisory GHSA-4rwg-6mr4-55hc. The patch moves the k_work_reschedule call after the FCS and ADV_LINK_INVALID checks so invalidated links can no longer be kept alive by incoming packets.

Workarounds

Restrict physical access and RF proximity to Mesh devices during provisioning windows to limit attacker positioning.
Reduce the configured provisioning protocol timeout where the application allows, so pinned links recover faster after attack cessation.
Where feasible, disable the PB-ADV bearer and rely on PB-GATT for provisioning until firmware is patched.

bash

# Rebuild Zephyr with the upstream fix
git clone https://github.com/zephyrproject-rtos/zephyr.git
cd zephyr
git cherry-pick 3f3c37edf80262b838ef5402fec9880c07892e4e
west build -b <board> samples/bluetooth/mesh
west flash