CVE-2026-15894: Bluetooth Mesh Proxy Solicitation RCE Flaw

CVE-2026-15894 Overview

CVE-2026-15894 is a stack buffer overflow in the Zephyr RTOS Bluetooth Mesh On-Demand Private Proxy solicitation handler. The flaw lives in subsys/bluetooth/mesh/solicitation.c, where sol_pdu_decrypt() copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. Because the copy occurs before decryption or authentication, an attacker in radio range can trigger the overflow without any pairing, bonding, or provisioning.

Critical Impact
An unauthenticated attacker within Bluetooth range can corrupt stack memory on any Zephyr node with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled, enabling reliable remote denial of service and plausible remote code execution.

Affected Products

Zephyr RTOS Bluetooth Mesh subsystem
Nodes with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled
Devices with GATT proxy disabled and On-Demand Private Proxy enabled

Discovery Timeline

2026-10-07 - CVE-2026-15894 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-15894

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow [CWE-121] in the Bluetooth Mesh solicitation path. In sol_pdu_decrypt(), out is allocated as NET_BUF_SIMPLE(17) and then populated with net_buf_simple_add_mem(out, in->data, in->len). The net_buf_simple_add() helper guards its tailroom only with __ASSERT_NO_MSG, which is compiled out in production builds. When in->len exceeds 17 bytes, the underlying memcpy writes attacker-controlled bytes past the 17-byte stack buffer.

Root Cause

The oversized length originates in the mesh scan callback in subsys/bluetooth/mesh/adv.c. That callback invokes net_buf_simple_restore() before dispatching to bt_mesh_sol_recv(), leaving buf->len covering the entire remaining advertising payload rather than only the Solicitation Service Data. After the parser locates the Service Data AD and consumes the Identification Type byte, buf->len still spans the 17-octet Network PDU plus any trailing advertising bytes. Prior to the fix, only a minimum-length check existed, so appended AD structures or padding pushed the copy past the stack boundary.

Attack Vector

bt_mesh_scan_cb() is registered directly as the BLE scan callback, meaning buf contains raw, unauthenticated advertising data received over the air. Any device within radio range can transmit a non-connectable advertisement carrying a crafted mesh Proxy Solicitation. The target must have CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled and currently be eligible for solicitation. No key material, pairing, or provisioning is required.

 		return;
 	}
 
+	/* Trim any trailing AD structures left attached by the scan callback:
+	 * the encrypted Solicitation PDU has a fixed length of 17 octets.
+	 */
+	if (buf->len < 17) {
+		LOG_DBG("Truncated Solicitation PDU (len %u)", buf->len);
+		return;
+	}
+	buf->len = 17;
+
 	sub = bt_mesh_subnet_find(sol_pdu_decrypt, (void *)buf);
 	if (!sub) {
 		LOG_DBG("Unable to find subnetwork for received solicitation PDU");

Source: Zephyr Project GitHub Commit 4416ad1

The patch clamps buf->len to the spec-fixed 17 octets before decryption and drops any PDU shorter than that minimum.

Detection Methods for CVE-2026-15894

Indicators of Compromise

Unexpected device resets, hard faults, or stack-canary panics on Zephyr nodes running Bluetooth Mesh with On-Demand Private Proxy enabled.
Non-connectable BLE advertisements containing Mesh Proxy Solicitation Service Data (UUID 0x1859) with trailing AD structures beyond the 17-octet Network PDU.
Log entries from sol_pdu_decrypt referencing truncated or oversized solicitation PDUs.

Detection Strategies

Capture nearby BLE advertising traffic with a sniffer and flag any Solicitation Service Data payload whose total length exceeds the spec-fixed 17 octets after the Identification Type byte.
Instrument firmware builds with stack canaries and MPU-based stack protection to surface overwrite attempts during fuzz and field testing.
Correlate device crash telemetry with proximity-based BLE scanning events to identify radio-adjacent exploitation attempts.

Monitoring Recommendations

Enable verbose logging in subsys/bluetooth/mesh/solicitation.c during triage to capture malformed PDUs.
Monitor fleets of mesh-enabled devices for repeated reboots or watchdog resets clustered by location.
Track upstream Zephyr security advisories such as GHSA-x37p-38wq-cgwj for related mesh subsystem fixes.

How to Mitigate CVE-2026-15894

Immediate Actions Required

Apply the upstream Zephyr patch that clamps buf->len to 17 octets before decryption in sol_pdu_decrypt().
Rebuild and reflash all affected devices that enable CONFIG_BT_MESH_OD_PRIV_PROXY_SRV.
Inventory deployed firmware images to identify every product line that includes the vulnerable mesh solicitation handler.

Patch Information

The fix is available in Zephyr commit 4416ad13677259d180f35ce44338578694e48184. The patch adds an explicit minimum-length check and trims buf->len to the spec-fixed 17 octets before dispatching to bt_mesh_subnet_find(). Full details are published in the Zephyr Security Advisory GHSA-x37p-38wq-cgwj.

Workarounds

Disable CONFIG_BT_MESH_OD_PRIV_PROXY_SRV in Kconfig if On-Demand Private Proxy is not required for your deployment.
Enable the GATT proxy feature where appropriate, which removes solicitation eligibility and prevents reaching the vulnerable path.
Restrict device deployment to physically controlled environments until firmware updates are distributed, since the attack requires radio adjacency.

bash

# Kconfig workaround: disable the vulnerable server component
CONFIG_BT_MESH_OD_PRIV_PROXY_SRV=n