Executive brief
A vulnerability in the Bluetooth Mesh component of the Zephyr operating system allows a nearby attacker to prevent a device from being set up or reconfigured. By sending specific wireless signals, an attacker can trick the device into keeping a failed connection open indefinitely, blocking legitimate management attempts. This results in a persistent denial of service where the device remains unprovisionable until it is manually reset.
Technical details
A vulnerability exists in the Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c) where the `prov_msg_recv()` function unconditionally reschedules the protocol watchdog timer before performing validity checks. An unauthenticated attacker within Bluetooth range can induce a provisioning failure and then continuously transmit FCS-valid PB-ADV packets to reset the timer. This prevents the `protocol_timeout` from firing, which is the only mechanism to tear down an invalidated link and re-enable the unprovisioned device beacon. Consequently, the device remains in a dead state where new provisioning requests are rejected. The fix involves moving the timer reschedule logic to occur only after the FCS and link validity checks.
Affected products
- Zephyr Project Zephyr RTOS >= 3.5.0, <= 4.4.1
Timeline
- 2026-07-20: advisory: GitHub Security Advisory GHSA-4rwg-6mr4-55hc published
- 2026-07-21: disclosed: CVE-2026-10675 published to NVD
- patched: Fixed in Zephyr version 4.5.0 and backported to 4.4, 4.3, and 3.7 branches