PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10675 zephyrproject CVE debrief

CVE-2026-10675 is a denial of service vulnerability in Zephyr's Bluetooth Mesh PB-ADV provisioning bearer. A remote, unauthenticated attacker can induce a persistent denial of provisioning/re-provisioning service by exploiting this vulnerability. The vulnerability exists because the provisioning protocol watchdog timer is rescheduled unconditionally at the top of the prov_msg_recv() function, before the FCS check and before the ADV_LINK_INVALID check. This allows an attacker to reset the timer even on an invalidated link, preventing the protocol_timeout function from firing and the dead link from being torn down. As a result, the device remains pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.

Vendor
zephyrproject
Product
zephyr
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Organizations using Zephyr's Bluetooth Mesh PB-ADV provisioning bearer should apply patches to prevent denial of service attacks. They should also review their systems for signs of attempted exploitation and ensure that their systems are configured to detect and prevent similar attacks in the future. Additionally, organizations should prioritize patching systems that are most vulnerable to exploitation, such as those that are exposed to the internet or have high-value assets.

Technical summary

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer, a remote, unauthenticated attacker can induce a provisioning failure and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout, causing a persistent denial of provisioning/re-provisioning service. The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check and FCS check before the reset, preventing an attacker from keeping a link alive indefinitely.

Defensive priority

High

Recommended defensive actions

  • Apply patches to Zephyr's Bluetooth Mesh PB-ADV provisioning bearer
  • Inventory and monitor affected systems
  • Implement compensating controls to detect and prevent similar attacks
  • Review system logs for signs of attempted exploitation
  • Verify that systems are running a version of Zephyr with the fix applied
  • Ensure that systems are configured to detect and prevent similar attacks in the future
  • Prioritize patching systems that are most vulnerable to exploitation

Evidence notes

The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check and FCS check before the reset. This change prevents an attacker from keeping a link alive indefinitely. Defenders should verify that their systems are running a version of Zephyr with this fix applied. They should also review their systems for signs of attempted exploitation, such as repeated provisioning attempts from the same link ID. Additionally, defenders should ensure that their systems are configured to detect and prevent similar attacks in the future.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10675 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10675

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10675 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10675

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.