EUVD-2026-46445Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent vector (BLE range required), no privileges or interaction needed, availability-only impact limited to provisioning service.
Primary rating from Vendor (zephyr).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV_LINK_INVALID check. Once a provisioning attempt fails, prov_failed() sets ADV_LINK_INVALID and the only recovery path is the protocol timer firing (protocol_timeout -> prov_link_close -> close_link -> reset_adv_link and re-enabling of scanning and the unprovisioned device beacon).
A remote, unauthenticated attacker on the BLE advertising channel can first induce a provisioning failure (e.g. with a malformed generic-provisioning PDU) and then transmit any FCS-valid PB-ADV transaction PDU on the same link ID more often than once per protocol timeout (60 s, or 120 s for OOB input/output). Because each such packet reset the timer even on an invalidated link, protocol_timeout never fired, the dead link was never torn down, and the device remained pinned in an un-provisionable state with its unprovisioned beacon disabled and new Link Open requests rejected.
PB-ADV PDUs are processed without authentication and the FCS is a keyless CRC, so no pairing or prior trust is required and the attacker chooses the link ID itself. The impact is a persistent denial of provisioning/re-provisioning service; there is no memory-safety, confidentiality, or integrity impact.
The vulnerable code shipped in releases through v4.4.1. The fix moves the timer reschedule to after the ADV_LINK_INVALID check (and the FCS check before the reset) so an invalidated link can no longer be kept alive by incoming packets.
AnalysisAI
Zephyr RTOS Bluetooth Mesh PB-ADV provisioning can be permanently denied on any affected device within BLE advertising range by an unauthenticated remote attacker exploiting a timer-reset logic flaw in subsys/bluetooth/mesh/pb_adv.c. The watchdog timer governing protocol timeouts was rescheduled unconditionally before validity checks, allowing an attacker to hold a dead provisioning link open indefinitely by sending FCS-valid PDUs faster than the 60-120 second timeout interval. The device's unprovisioned beacon is suppressed and all new Link Open requests are rejected for as long as the attacker transmits, rendering the device permanently un-provisionable without a reboot. No public exploit is identified and the vulnerability is not listed in CISA KEV, though the attack requires no authentication and low complexity to execute from within BLE range.
Technical ContextAI
The PB-ADV (Provisioning Bearer - Advertising) transport in Bluetooth Mesh carries out device provisioning over raw BLE advertising PDUs. In Zephyr's implementation (subsys/bluetooth/mesh/pb_adv.c), the function prov_msg_recv() is the entry point for incoming PB-ADV transaction PDUs. Prior to the fix, this function called k_work_reschedule() on the protocol watchdog (link.prot_timer) unconditionally at the very top of the function - before the keyless CRC (FCS) validation and before checking the ADV_LINK_INVALID flag. After a provisioning failure, prov_failed() sets ADV_LINK_INVALID and the only recovery is the protocol timer firing (protocol_timeout → prov_link_close → close_link → reset_adv_link), which re-enables BLE scanning and the unprovisioned beacon. Because the timer was reset on every incoming PDU regardless of link state, an attacker could prevent that recovery path from ever executing. The CWE-400 root cause (Uncontrolled Resource Consumption) manifests here as perpetual timer deferral consuming the device's single provisioning-state slot. The FCS is a CRC-8 with no key, so crafting FCS-valid PDUs requires only standard BLE tooling. The commit diff (3f3c37edf80262b838ef5402fec9880c07892e4e) confirms the fix: the timer reschedule call is removed from prov_failed() and repositioned in prov_msg_recv() to execute only after both the FCS and ADV_LINK_INVALID checks pass. CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade to Zephyr 4.5.0 or later, which incorporates the upstream fix at commit 3f3c37edf80262b838ef5402fec9880c07892e4e (https://github.com/zephyrproject-rtos/zephyr/commit/3f3c37edf80262b838ef5402fec9880c07892e4e). The patch repositions the protocol timer reschedule call in prov_msg_recv() to execute only after the FCS validity check and the ADV_LINK_INVALID check, preventing dead links from being kept alive by incoming packets. Refer to GHSA-4rwg-6mr4-55hc (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4rwg-6mr4-55hc) for the vendor advisory. If an immediate upgrade is not feasible, compensating controls include: (1) Disabling BT Mesh PB-ADV provisioning and using PB-GATT if application topology allows - this eliminates the vulnerable code path entirely but requires GATT-capable provisioners; (2) Physically restricting BLE advertising channel access via RF shielding or directional antenna deployments in sensitive environments, accepting the trade-off of reduced provisioning range; (3) Implementing periodic watchdog-triggered reboots of mesh nodes (e.g., daily maintenance window reboot) to recover from any stuck provisioning state, accepting brief service interruptions. Note that the patched version has not been confirmed as a tagged stable release at the time of this analysis - verify that 4.5.0 is formally released before deploying in production.
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system. Rated critical severity (CVSS 10.0),
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. Rated critical severity (CVSS 9.8), this vulnerabilit
Unchecked user input length in /subsys/net/l2/wifi/wifi_shell.c can cause buffer overflows. Rated critical severity (CVS
Potential buffer overflow vulnerability in the Zephyr CAN bus subsystem. Rated critical severity (CVSS 9.8), this vulner
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Rated critical severity (CVSS 9.8), this vulnerability
Buffer overflow in Zephyr USB DFU DNLOAD. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Rated critical severity (CVSS 9.8), this vul
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get(
Potential buffer overflow vulnerabilities n the Zephyr Bluetooth subsystem. Rated critical severity (CVSS 9.6), this vul
Buffer overflow in Zephyr RTOS dns_unpack_name() function causing OOB writes. PoC available.
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte
Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today