PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10774 zephyrproject CVE debrief

Zephyr's Bluetooth Mesh implementation has a vulnerability (CVE-2026-10774) that causes an imbalance in PSA Crypto key slots used for subnet keys. When CONFIG_BT_MESH_PRIV_BEACONS is enabled, a key slot is imported but not properly released due to a mismatch in configuration guards. This leads to a gradual exhaustion of the PSA key slot pool, affecting not only Bluetooth Mesh functionality but also other PSA crypto consumers on the device. The vulnerability has a low CVSS score of 2.4 and is considered low-priority for defensive review. Organizations using Zephyr's Bluetooth Mesh, especially those with custom configurations or high-usage scenarios, should review and apply the patch from the Zephyr project. The patch aligns the destroy guard with the import guard (CONFIG_BT_MESH_PRIV_BEACONS) so each slot is freed. Affected deployments should verify and update CONFIG_BT_MESH_PRIV_BEACONS and CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT configurations, monitor PSA key slot usage and system logs for potential exhaustion, and confirm whether affected product deployments exist in managed environments.

Vendor
zephyrproject
Product
zephyr
CVSS
LOW 2.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-02
Original CVE updated
2026-08-02
Advisory published
2026-08-02
Advisory updated
2026-08-02

Who should care

Organizations using Zephyr's Bluetooth Mesh implementation, especially those with custom configurations or high-usage scenarios, should review and apply the patch. Additionally, developers working with Zephyr's Bluetooth stack or PSA crypto APIs should be aware of this issue to prevent similar problems in the future. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed and assessed for potential exposure.

Technical summary

The vulnerability is caused by an imbalance in the teardown of PSA Crypto key slots used for subnet keys in Zephyr's Bluetooth Mesh implementation. When CONFIG_BT_MESH_PRIV_BEACONS is enabled, a key slot is imported but not properly released due to a mismatch in configuration guards. This leads to a gradual exhaustion of the PSA key slot pool, affecting not only Bluetooth Mesh functionality but also other PSA crypto consumers on the device. The fix aligns the destroy guard with the import guard (CONFIG_BT_MESH_PRIV_BEACONS) so each slot is freed.

Defensive priority

Low-priority defensive review recommended due to low CVSS score and limited attack surface.

Recommended defensive actions

  • Review and apply the patch from the Zephyr project
  • Verify and update CONFIG_BT_MESH_PRIV_BEACONS and CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT configurations
  • Monitor PSA key slot usage and system logs for potential exhaustion
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official CVE and NVD sources indicate a low-severity vulnerability in Zephyr's Bluetooth Mesh subnet key management. The vulnerability is caused by a mismatch in configuration guards, leading to a memory leak of PSA Crypto key slots. The attack requires high privileges and physical proximity to the device. Affected deployments should review and apply the patch from the Zephyr project, verify and update CONFIG_BT_MESH_PRIV_BEACONS and CONFIG_MBEDTLS_PSA_KEY_SLOT_COUNT configurations, and monitor PSA key slot usage and system logs for potential exhaustion.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-02T15:16:33.793Z and has not been modified since then.