CVE-2026-10675: Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pbadv.c), provmsgrecv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed() sets ADVLINKINVALID and the only recovery path is the protocol timer firing (protocoltimeout -> provlinkclose -> closelink -> resetadvlink and re-enabling of scanning and the unprovisioned device beacon).
A remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocoltimeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.
PB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact.
The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADVLINKINVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v4.4.1 - Configuration
Apply the code fix described: in prov_msg_recv(), do not reschedule the provisioning protocol watchdog timer unconditionally at the top of the function; instead reschedule only after validating that the link is not invalidated (ADV_LINK_INVALID) and after the FCS check. This ensures protocol_timeout can fire and prov_failed() invalidated links are torn down normally.
Zephyr Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c) prov_msg_recv() watchdog timer reschedule position = Move the timer reschedule to after the ADV_LINK_INVALID check; perform the FCS check before resetting/closing the provisioning link so invalidated links cannot be kept alive indefinitely by incoming packets. - Compensating control
For vulnerable Bluetooth Mesh PB-ADV provisioning bearer behavior (subsys/bluetooth/mesh/pb_adv.c), prevent attackers from being able to send PB-ADV PDUs on the same advertising link IDs by restricting BLE advertising/provisioning access (e.g., limit BLE exposure / restrict proximity / use network isolation around the device so untrusted parties cannot interact with PB-ADV advertising).