Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-10675— Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 zephyrproject Zephyr 4.4.1及之前版本存在资源管理错误漏洞，该漏洞源于在Bluetooth Mesh PB-ADV provisioning bearer中，prov_msg_recv()函数无条件重新调度协议看门狗定时器，即使链接已失效，导致远程未经验证攻击者通过BLE广播信道可发起持续性拒绝服务攻击，使设备保持在无法配置状态。

CVSS 4.3 · Medium EPSS 0.39% · P31

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 3.5.0< 4.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-10675

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)
Source: CVE Program / CVE List V5
Vulnerability Description
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon). A remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected. PB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact. The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
zephyrproject zephyr 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 zephyrproject Zephyr 4.4.1及之前版本存在资源管理错误漏洞，该漏洞源于在Bluetooth Mesh PB-ADV provisioning bearer中，prov_msg_recv()函数无条件重新调度协议看门狗定时器，即使链接已失效，导致远程未经验证攻击者通过BLE广播信道可发起持续性拒绝服务攻击，使设备保持在无法配置状态。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.5.0 ~ 4.5.0 -

II. Public POCs for CVE-2026-10675

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-10675

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-10675 (1)

Vendor Advisories for CVE-2026-10675 (1)

Same Patch Batch · zephyrproject · 2026-07-21 · 6 CVEs total

CVE-2026-10678 8.1 HIGH NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an una
CVE-2026-10680 7.6 HIGH Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t`
CVE-2026-10677 6.5 MEDIUM Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the
CVE-2026-10674 5.5 MEDIUM DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disab
CVE-2026-10679 3.3 LOW Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-400

V. Comments for CVE-2026-10675

No comments yet

Leave a comment