CVE-2026-10675

{
  "id": "CVE-2026-10675",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:16:59.800",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon).\n\nA remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.\n\nPB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact.\n\nThe vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets."
    },
    {
      "lang": "es",
      "value": "En el portador de aprovisionamiento PB-ADV de Bluetooth Mesh de Zephyr (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() reprogramó el temporizador de vigilancia del protocolo de aprovisionamiento incondicionalmente al inicio de la función, antes de la verificación FCS y antes de la verificación ADV_LINK_INVALID. Una vez que un intento de aprovisionamiento falla, prov_failed() establece ADV_LINK_INVALID y la única ruta de recuperación es el disparo del temporizador del protocolo (protocol_timeout   ->   prov_link_close   ->   close_link   ->   reset_adv_link y la reactivación del escaneo y la baliza del dispositivo no aprovisionado).\n\nUn atacante remoto, no autenticado, en el canal de publicidad BLE puede primero inducir un fallo de aprovisionamiento (p. ej., con una PDU de aprovisionamiento genérico malformada) y luego transmitir cualquier PDU de transacción PB-ADV válida en FCS en el mismo ID de enlace más a menudo que una vez por tiempo de espera del protocolo (60 s, o 120 s para entrada/salida OOB). Debido a que cada paquete de este tipo reiniciaba el temporizador incluso en un enlace invalidado, protocol_timeout nunca se disparó, el enlace muerto nunca se desmanteló, y el dispositivo permaneció anclado en un estado no aprovisionable con su baliza no aprovisionada deshabilitada y las nuevas solicitudes de apertura de enlace rechazadas.\n\nLas PDU PB-ADV se procesan sin autenticación y el FCS es un CRC sin clave, por lo que no se requiere emparejamiento ni confianza previa y el atacante elige el propio ID de enlace. El impacto es una denegación persistente del servicio de aprovisionamiento/reaprovisionamiento; no hay impacto en la seguridad de la memoria, la confidencialidad o la integridad.\n\nEl código vulnerable se envió en versiones hasta la v4.4.1. La solución mueve la reprogramación del temporizador a después de la verificación ADV_LINK_INVALID (y la verificación FCS antes del reinicio) para que un enlace invalidado ya no pueda mantenerse activo por los paquetes entrantes."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/bluetooth/mesh/pb_adv.c"
          ],
          "versions": [
            {
              "version": "3.5.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:32:13.205050Z",
          "id": "CVE-2026-10675",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.5.0",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "A75EE6DD-AF65-48E8-9A89-7C8150B6815E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/3f3c37edf80262b838ef5402fec9880c07892e4e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4rwg-6mr4-55hc",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}