CVE-2026-10675

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10675", "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "state": "PUBLISHED", "assignerShortName": "zephyr", "dateReserved": "2026-06-02T15:26:04.929Z", "datePublished": "2026-07-21T21:30:54.165Z", "dateUpdated": "2026-11-04T04:58:53.721Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "shortName": "zephyr", "dateUpdated": "2026-11-04T04:58:53.721Z"}, "title": "Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)", "descriptions": [{"lang": "en", "value": "In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon).\n\nA remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.\n\nPB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact.\n\nThe vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets."}], "affected": [{"vendor": "zephyrproject", "product": "zephyr", "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "packageName": "zephyr", "defaultStatus": "unaffected", "programFiles": ["subsys/bluetooth/mesh/pb_adv.c"], "versions": [{"version": "3.5.0", "status": "affected", "versionType": "semver", "lessThan": "4.3.1"}, {"version": "4.4.0", "status": "affected", "versionType": "semver", "lessThan": "4.4.2"}]}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/3f3c37edf80262b838ef5402fec9880c07892e4e", "name": "Fix commit", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4rwg-6mr4-55hc", "name": "GHSA-4rwg-6mr4-55hc"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "dos", "cweId": "CWE-400", "type": "CWE"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T19:32:13.205050Z", "id": "CVE-2026-10675", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T19:37:01.018Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10675", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:32:13.205050Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T19:32:14.919Z"}}], "cna": {"title": "Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "affected": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "3.5.0", "lessThan": "4.3.1", "versionType": "semver"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["subsys/bluetooth/mesh/pb_adv.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/3f3c37edf80262b838ef5402fec9880c07892e4e", "name": "Fix commit", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4rwg-6mr4-55hc", "name": "GHSA-4rwg-6mr4-55hc"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon).\n\nA remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.\n\nPB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact.\n\nThe vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "dos"}]}], "providerMetadata": {"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "shortName": "zephyr", "dateUpdated": "2026-11-04T04:58:53.721Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10675", "state": "PUBLISHED", "dateUpdated": "2026-11-04T04:58:53.721Z", "dateReserved": "2026-06-02T15:26:04.929Z", "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "datePublished": "2026-07-21T21:30:54.165Z", "assignerShortName": "zephyr"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected", "packageName": "zephyr", "product": "zephyr", "programFiles": ["subsys/bluetooth/mesh/pb_adv.c"], "vendor": "zephyrproject", "versions": [{"lessThan": "4.3.1", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "4.4.2", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "vulnerabilities@zephyrproject.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "matchCriteriaId": "A75EE6DD-AF65-48E8-9A89-7C8150B6815E", "versionEndIncluding": "4.4.1", "versionStartIncluding": "3.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon).\n\nA remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.\n\nPB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact.\n\nThe vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets."}, {"lang": "es", "value": "En el portador de aprovisionamiento PB-ADV de Bluetooth Mesh de Zephyr (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() reprogram\u00f3 el temporizador de vigilancia del protocolo de aprovisionamiento incondicionalmente al inicio de la funci\u00f3n, antes de la verificaci\u00f3n FCS y antes de la verificaci\u00f3n ADV_LINK_INVALID. Una vez que un intento de aprovisionamiento falla, prov_failed() establece ADV_LINK_INVALID y la \u00fanica ruta de recuperaci\u00f3n es el disparo del temporizador del protocolo (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link y la reactivaci\u00f3n del escaneo y la baliza del dispositivo no aprovisionado).\n\nUn atacante remoto, no autenticado, en el canal de publicidad BLE puede primero inducir un fallo de aprovisionamiento (p. ej., con una PDU de aprovisionamiento gen\u00e9rico malformada) y luego transmitir cualquier PDU de transacci\u00f3n PB-ADV v\u00e1lida en FCS en el mismo ID de enlace m\u00e1s a menudo que una vez por tiempo de espera del protocolo (60 s, o 120 s para entrada/salida OOB). Debido a que cada paquete de este tipo reiniciaba el temporizador incluso en un enlace invalidado, protocol_timeout nunca se dispar\u00f3, el enlace muerto nunca se desmantel\u00f3, y el dispositivo permaneci\u00f3 anclado en un estado no aprovisionable con su baliza no aprovisionada deshabilitada y las nuevas solicitudes de apertura de enlace rechazadas.\n\nLas PDU PB-ADV se procesan sin autenticaci\u00f3n y el FCS es un CRC sin clave, por lo que no se requiere emparejamiento ni confianza previa y el atacante elige el propio ID de enlace. El impacto es una denegaci\u00f3n persistente del servicio de aprovisionamiento/reaprovisionamiento; no hay impacto en la seguridad de la memoria, la confidencialidad o la integridad.\n\nEl c\u00f3digo vulnerable se envi\u00f3 en versiones hasta la v4.4.1. La soluci\u00f3n mueve la reprogramaci\u00f3n del temporizador a despu\u00e9s de la verificaci\u00f3n ADV_LINK_INVALID (y la verificaci\u00f3n FCS antes del reinicio) para que un enlace invalidado ya no pueda mantenerse activo por los paquetes entrantes."}], "id": "CVE-2026-10675", "lastModified": "2026-10-24T19:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "vulnerabilities@zephyrproject.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10675", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T19:32:13.205050Z", "version": "2.0.3"}}]}, "published": "2026-07-21T22:16:59.800", "references": [{"source": "vulnerabilities@zephyrproject.org", "tags": ["Patch"], "url": "https://github.com/zephyrproject-rtos/zephyr/commit/3f3c37edf80262b838ef5402fec9880c07892e4e"}, {"source": "vulnerabilities@zephyrproject.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4rwg-6mr4-55hc"}], "sourceIdentifier": "vulnerabilities@zephyrproject.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "vulnerabilities@zephyrproject.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,4.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "zephyr", "source": "cna", "vendor": "zephyrproject"}, "product": "zephyr", "vendor": "zephyrproject"}], "created": "2026-07-22T19:45:16.862415+00:00", "updated": "2026-07-30T16:15:04.458050+00:00", "vendors": ["zephyrproject", "zephyrproject$PRODUCT$zephyr"]}