PatchSiren cyber security CVE debrief
CVE-2026-10675 zephyrproject CVE debrief
CVE-2026-10675 is a denial of service vulnerability in Zephyr's Bluetooth Mesh PB-ADV provisioning bearer. A remote, unauthenticated attacker can induce a persistent denial of provisioning/re-provisioning service by exploiting this vulnerability. The vulnerability exists because the provisioning protocol watchdog timer is rescheduled unconditionally at the top of the prov_msg_recv() function, before the FCS check and before the ADV_LINK_INVALID check. This allows an attacker to reset the timer even on an invalidated link, preventing the protocol_timeout function from firing and the dead link from being torn down. As a result, the device remains pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.
- Vendor
- zephyrproject
- Product
- zephyr
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Organizations using Zephyr's Bluetooth Mesh PB-ADV provisioning bearer should apply patches to prevent denial of service attacks. They should also review their systems for signs of attempted exploitation and ensure that their systems are configured to detect and prevent similar attacks in the future. Additionally, organizations should prioritize patching systems that are most vulnerable to exploitation, such as those that are exposed to the internet or have high-value assets.
Technical summary
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer, a remote, unauthenticated attacker can induce a provisioning failure and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout, causing a persistent denial of provisioning/re-provisioning service. The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check and FCS check before the reset, preventing an attacker from keeping a link alive indefinitely.
Defensive priority
High
Recommended defensive actions
- Apply patches to Zephyr's Bluetooth Mesh PB-ADV provisioning bearer
- Inventory and monitor affected systems
- Implement compensating controls to detect and prevent similar attacks
- Review system logs for signs of attempted exploitation
- Verify that systems are running a version of Zephyr with the fix applied
- Ensure that systems are configured to detect and prevent similar attacks in the future
- Prioritize patching systems that are most vulnerable to exploitation
Evidence notes
The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check and FCS check before the reset. This change prevents an attacker from keeping a link alive indefinitely. Defenders should verify that their systems are running a version of Zephyr with this fix applied. They should also review their systems for signs of attempted exploitation, such as repeated provisioning attempts from the same link ID. Additionally, defenders should ensure that their systems are configured to detect and prevent similar attacks in the future.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:16:59.800Z and has not been modified since then.