PT-2026-62123 · Zephyr · Zephyr

CVE-2026-10675 · Published 2026-07-21 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.2

Description In the Bluetooth Mesh PB-ADV provisioning bearer, the prov msg recv() function in subsys/bluetooth/mesh/pb adv.c unconditionally reschedules the provisioning protocol watchdog timer before performing the FCS check and the ADV LINK INVALID check. A remote, unauthenticated attacker on the BLE advertising channel can induce a provisioning failure using a malformed generic-provisioning PDU. By subsequently transmitting FCS-valid PB-ADV transaction PDUs on the same link ID more frequently than the protocol timeout (60 or 120 seconds), the attacker can prevent the protocol timeout from firing. This prevents the dead link from being torn down, leaving the device in an un-provisionable state where the unprovisioned beacon is disabled and new Link Open requests are rejected, resulting in a persistent denial of provisioning and re-provisioning services. The FCS (Frame Check Sequence) is a keyless CRC, meaning no prior trust or pairing is required for this exploitation.

Recommendations Update Zephyr to version 4.4.2 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-10675

GHSA-4RWG-6MR4-55HC

Affected Products

Zephyr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10675.json · Exploit
• https://github.com/zephyrproject-rtos/zephyr/commit/3f3c37edf80262b838ef5402fec9880c07892e4e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10675 · Security Note
• https://osv.dev/vulnerability/CVE-2026-10675 · Vendor Advisory
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4rwg-6mr4-55hc · Note
• https://github.com/zephyrproject-rtos/zephyr · Note