CVE-2026-10774: Zephyr Bluetooth Mesh DoS Vulnerability

CVE-2026-10774 Overview

CVE-2026-10774 is a memory leak vulnerability [CWE-401] in the Zephyr real-time operating system's Bluetooth Mesh subnet key management. The flaw resides in subsys/bluetooth/mesh/subnet.c, where net_keys_create() imports the Private Beacon Key into a Platform Security Architecture (PSA) Crypto key slot, but the matching psa_destroy_key() call in subnet_keys_destroy() is guarded by a Kconfig symbol that no longer exists. Each subnet teardown leaks one PSA key slot. With the default CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT of 16, roughly a dozen key-refresh or subnet add/delete cycles exhaust the slot pool.

Critical Impact
Once the PSA key slot pool is exhausted, the affected Bluetooth Mesh node cannot add subnets, complete key refresh, or serve other PSA crypto consumers until it is rebooted.

Affected Products

Zephyr Project Real-Time Operating System (Bluetooth Mesh subsystem)
Builds with CONFIG_BT_MESH_PRIV_BEACONS enabled (default configuration)
Nodes provisioned into a Bluetooth Mesh network

Discovery Timeline

2026-08-02 - CVE-2026-10774 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-10774

Vulnerability Analysis

The vulnerability is a resource leak in Zephyr's Bluetooth Mesh subnet key lifecycle. The net_keys_create() function imports the Private Beacon Key into a PSA Crypto key slot whenever CONFIG_BT_MESH_PRIV_BEACONS is enabled. The paired teardown in subnet_keys_destroy() was guarded by CONFIG_BT_MESH_V1d1, a symbol removed when explicit Mesh 1.0.1 support was dropped. The destroy branch became permanently dead code.

Every subnet teardown path triggers the imbalance. This includes Config Server NetKey Delete operations, Key Refresh Procedure completion, and node reset or re-provisioning. Repeated cycles exhaust the shared PSA key-slot pool. Once the pool is exhausted, bt_mesh_private_beacon_key() fails, and subnet creation on the node halts. Other PSA crypto consumers on the same device are also starved until a reboot restores the slot pool.

Root Cause

The root cause is a mismatched Kconfig guard between the key import and destroy paths [CWE-401]. When Mesh 1.0.1 support was removed, the CONFIG_BT_MESH_V1d1 symbol was deleted, but the destroy site referencing it was not migrated to the still-active CONFIG_BT_MESH_PRIV_BEACONS guard. The preprocessor silently elided the destroy call.

Attack Vector

The over-the-air triggers that reach the leaking teardown are processed only under the node's device key. Exploitation requires the provisioner or network administrator that owns the node, operating over the Bluetooth Mesh network (adjacent network). An authorized administrator issuing repeated NetKey Delete or Key Refresh operations can render the node unable to manage subnets or perform key refresh until it is rebooted.

 #if defined(CONFIG_BT_MESH_GATT_PROXY)
 	bt_mesh_key_destroy(&key->identity);
 #endif
-#if defined(CONFIG_BT_MESH_V1d1)
+#if defined(CONFIG_BT_MESH_PRIV_BEACONS)
 	bt_mesh_key_destroy(&key->priv_beacon);
 #endif
 }
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/f573da9f53630082ae95fcfd39fb021fe15f7abd

The patch aligns the destroy guard with the import guard so each imported Private Beacon Key slot is freed on teardown.

Detection Methods for CVE-2026-10774

Indicators of Compromise

Failures returned by bt_mesh_private_beacon_key() and subsequent subnet creation errors after repeated key-refresh cycles.
PSA Crypto API calls returning PSA_ERROR_INSUFFICIENT_MEMORY on a device that previously operated normally.
A Bluetooth Mesh node that recovers full functionality only after a reboot following administrative NetKey activity.

Detection Strategies

Audit Zephyr build configurations for CONFIG_BT_MESH_PRIV_BEACONS=y combined with unpatched Bluetooth Mesh sources predating commit f573da9f.
Instrument firmware test harnesses to loop NetKey Add and NetKey Delete operations while monitoring PSA key slot occupancy.
Track Config Server NetKey Delete and Key Refresh Procedure completion counters against available PSA key slots.

Monitoring Recommendations

Enable diagnostic logging around net_keys_create() and subnet_keys_destroy() to observe balanced import and destroy calls.
Alert on Bluetooth Mesh nodes that require reboots correlated with administrative key management activity.
Include PSA key-slot utilization in device health telemetry exported from fleet-managed Mesh nodes.

How to Mitigate CVE-2026-10774

Immediate Actions Required

Apply the upstream Zephyr fix from commit f573da9f53630082ae95fcfd39fb021fe15f7abd to align the destroy guard with CONFIG_BT_MESH_PRIV_BEACONS.
Rebuild and reflash affected Bluetooth Mesh devices with the patched subsys/bluetooth/mesh/subnet.c.
Restrict provisioner and network administrator access to trusted operators until patched firmware is deployed.

Patch Information

The fix is available in the Zephyr project via GitHub commit f573da9f and documented in GitHub Security Advisory GHSA-6q7g-798f-76p2. The change replaces the stale CONFIG_BT_MESH_V1d1 guard with CONFIG_BT_MESH_PRIV_BEACONS so the Private Beacon Key slot is freed on every subnet teardown.

Workarounds

Increase CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT above the default of 16 to delay exhaustion, understanding this only postpones the failure.
Disable CONFIG_BT_MESH_PRIV_BEACONS in the Zephyr build when Private Beacons are not required, which avoids the leaking import path entirely.
Schedule periodic reboots of Bluetooth Mesh nodes that undergo frequent key-refresh cycles until firmware is patched.

bash

# Configuration example: rebuild Zephyr Bluetooth Mesh sample with the patched tree
west update
git -C zephyr log --oneline f573da9f53630082ae95fcfd39fb021fe15f7abd -1
west build -b <board> samples/bluetooth/mesh -p auto
west flash