Zephyr RTOS EUVD-2026-46445

Exploitation requires: (1) Bluetooth Mesh PB-ADV provisioning bearer must be enabled on the target device - devices using PB-GATT-only provisioning or with BT Mesh disabled are not affected; (2) The target device must be in an unprovisioned state (not yet commissioned into a mesh network) so that it is accepting Link Open requests and processing PB-ADV PDUs; (3) The attacker must be within BLE advertising range (typically 10-100 m line-of-sight) to transmit on the advertising channel - the CVSS AV:A vector is confirmed by the vendor description; (4) No authentication, pairing, or prior trust relationship is required - PB-ADV PDUs are processed without authentication and the FCS is a keyless CRC-8, meaning any BLE-capable device can craft valid PDUs. Limiting factors are the adjacent-network constraint (physical proximity required), the requirement that the device be unprovisioned at the time of attack, and that the DoS persists only until the device is power-cycled or rebooted. There is no confidentiality, integrity, or memory-safety impact - the sole consequence is blocking the provisioning/re-provisioning workflow.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L scores 4.3 (Medium), which accurately reflects the constrained attack vector (BLE advertising range, roughly 10-100 m) and the bounded impact (availability of provisioning only - no memory-safety, confidentiality, or integrity consequence). The adjacent-vector requirement is the primary risk limiter: an attacker must have radio proximity to the target device, ruling out internet-scale exploitation. Attack complexity is genuinely low once in range - the FCS is a keyless CRC, the link ID is attacker-chosen, and the PDU format is fully specified by the Bluetooth Mesh specification. No privileges or user interaction are required. EPSS data is not provided; given the adjacent-only vector and niche embedded deployment context, opportunistic mass exploitation is unlikely. No CISA KEV listing and no known public exploit code further lower near-term risk. For deployments provisioning BLE Mesh nodes in physically accessible or semi-public spaces (warehouses, factories, smart building installations), the risk is elevated because an attacker with a BLE-capable device (e.g., a laptop or phone) could indefinitely block re-provisioning of nodes after any link failure without being detected by higher-layer systems. The persistent nature of the DoS - surviving until device reboot - makes it more severe in practice than the CVSS A:L score alone suggests.

An attacker equipped with a BLE-capable device and standard Bluetooth Mesh tooling positions themselves within radio range of an unprovisioned Zephyr Mesh node and transmits a malformed generic-provisioning PDU on a chosen link ID, inducing prov_failed() and setting ADV_LINK_INVALID on the target. The attacker then continues transmitting FCS-valid PB-ADV transaction PDUs on the same link ID at intervals shorter than 60 seconds; each packet resets the protocol watchdog timer, preventing protocol_timeout from ever firing and permanently suppressing the device's unprovisioned beacon. The node remains locked in a dead provisioning state - rejecting all legitimate Link Open requests from the network provisioner - until physically rebooted, achieving an indefinite denial of provisioning with no ongoing authentication requirement.