CVE-2026-10774— PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS
Quick assessment
Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 zephyrproject zephyr 3.6.0版本至4.5.0之前版本存在资源管理错误漏洞，该漏洞源于Bluetooth Mesh子网密钥管理中资源释放不平衡，subsys/bluetooth/mesh/subnet.c文件中的Private Beacon Key导入操作未被对应的销毁操作平衡，导致每次子网密钥销毁时泄漏一个PSA Crypto密钥槽，可能造成PSA密钥槽资源耗尽，节点无法添加子网或
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| zephyrproject | zephyr | 3.6.0< 4.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10774
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_keys_destroy() guarded the matching psa_destroy_key() with CONFIG_BT_MESH_V1d1. That Kconfig symbol was removed when explicit Mesh 1.0.1 support was dropped, so the destroy branch became permanently dead code and the import is never balanced by a destroy.
The imbalanced teardown is reached every time subnet keys are destroyed: deleting a subnet (Config Server NetKey Delete), completing a Key Refresh Procedure (which retires the old key set), and resetting/re-provisioning the node. The over-the-air triggers are processed only under the node's device key, so they are exercisable by the provisioner or network administrator that owns the node, reachable over the Bluetooth Mesh network.
With the default CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT of 16, repeated add/delete or key-refresh cycles exhaust the shared PSA key-slot pool after roughly a dozen rounds. Once exhausted, bt_mesh_private_beacon_key() and thus subnet creation fail: the node can no longer add subnets or complete key refresh, and other PSA crypto consumers on the device may be starved, until the device is rebooted. The fix aligns the destroy guard with the import guard (CONFIG_BT_MESH_PRIV_BEACONS) so each slot is freed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5
Vulnerability Title
zephyrproject zephyr 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 zephyrproject zephyr 3.6.0版本至4.5.0之前版本存在资源管理错误漏洞，该漏洞源于Bluetooth Mesh子网密钥管理中资源释放不平衡，subsys/bluetooth/mesh/subnet.c文件中的Private Beacon Key导入操作未被对应的销毁操作平衡，导致每次子网密钥销毁时泄漏一个PSA Crypto密钥槽，可能造成PSA密钥槽资源耗尽，节点无法添加子网或
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zephyrproject | zephyr | 3.6.0 ~ 4.5.0 | - |
|
II. Public POCs for CVE-2026-10774
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10774
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-10774 (1)
Vendor Advisories for CVE-2026-10774 (1)
IV. Related Vulnerabilities
Same product: zephyr
-
CVE-2026-12999
Infineon Airoc Wi-Fi driver leaks TX buffers on send failure -
CVE-2026-12634
Out-of-bounds stack write in the settings NVS backend from o -
CVE-2026-12522
Stack buffer overflow in Zephyr hl7800 modem driver parsing -
CVE-2026-12633
Out-of-bounds write in IPv6 6LoWPAN Context Option handling -
CVE-2026-12632
Out-of-bounds read in Zephyr PTP message parsing from unvali
Same vendor: zephyrproject
-
CVE-2026-12999
Infineon Airoc Wi-Fi driver leaks TX buffers on send failure -
CVE-2026-12634
Out-of-bounds stack write in the settings NVS backend from o -
CVE-2026-12522
Stack buffer overflow in Zephyr hl7800 modem driver parsing -
CVE-2026-12633
Out-of-bounds write in IPv6 6LoWPAN Context Option handling -
CVE-2026-12632
Out-of-bounds read in Zephyr PTP message parsing from unvali
Same weakness: CWE-401
-
CVE-2026-12999
Infineon Airoc Wi-Fi driver leaks TX buffers on send failure -
CVE-2026-76235
Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memo -
CVE-2026-52734
ZEBRA: Unbounded memory leak in mempool download pipeline vi -
CVE-2026-73565
@hono/node-server: Unauthenticated memory-leak DoS via abort -
CVE-2026-19382
Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory
V. Comments for CVE-2026-10774
No comments yet