Zephyr RTOS EUVD-2026-52002

CONFIG_BT_MESH_PRIV_BEACONS must be enabled in the build - this is the default for Zephyr Bluetooth Mesh builds and requires no special operator action to be vulnerable. The attacker must hold provisioner or network administrator status for the target mesh network, which grants access to the node's device key (PR:H per CVSS). Reachability is adjacent Bluetooth Mesh (AV:A), bounded by Bluetooth range and mesh topology. Exploitation requires roughly 12 or more repeated teardown cycles (NetKey Delete, Key Refresh Procedure completion, or reprovi­sioning) to exhaust the default 16-slot pool; a single operation causes a one-slot leak with no immediate observable effect. What limits exploitation: high-privilege access requirement eliminates unauthenticated or low-privilege threat actors; Bluetooth adjacency limits remote mass exploitation; a device reboot fully restores the key-slot pool; and the impact is denial-of-service to subnet operations only, with no confidentiality or integrity consequences.

The vendor-assigned CVSS 3.1 score of 2.4 (AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) accurately reflects the limited blast radius: exploitation requires adjacent Bluetooth Mesh reachability and a high-privilege provisioner or network administrator credential - attack surface is narrow by design. The availability impact is rated Low because the failure mode (slot exhaustion) is reversible via device reboot and affects only subnet operations plus potentially other PSA consumers, not a full system crash. No EPSS data was provided, no CISA KEV listing exists, and no public exploit or POC has been identified. The CVSS C:N/I:N components confirm there is no credential exposure or data tampering, consistent with CWE-401 scope. In practice, this vulnerability represents a maintenance concern for mesh network operators rather than an urgent incident-response priority: an attacker would need trusted provisioner status, physical proximity, and patience across roughly a dozen operations. The primary realistic threat actor is a malicious insider with legitimate network-admin access, not an opportunistic remote adversary.

A Bluetooth Mesh provisioner or network administrator with the target node's device key sends repeated Config Server NetKey Delete followed by NetKey Add commands over the mesh network. Each complete add/delete cycle leaks one PSA key slot. After approximately 12 to 16 cycles (depending on baseline slot usage), bt_mesh_private_beacon_key() returns a PSA error, subnet creation fails, and any other component on the device consuming PSA key slots may also begin to fail. The node remains in this degraded state until rebooted. No public proof-of-concept exists; the attack sequence is straightforward from the description and requires no exploit tooling beyond a standard Bluetooth Mesh stack.