CVE-2026-10675

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...

CVE-2026-10675

Zephyr Project Bluetooth Mesh PB-ADV vulnerability (CVE-2026-10675) in prov_msg_recv() reschedules the provisioning watchdog timer unconditionally at the top of the function, before FCS and ADV_LINK_INVALID checks. If a provisioning attempt fails (ADV_LINK_INVALID set), a malicious, unauthenticat...

PT-2026-62123

In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pb adv.c, prov msg recv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADV LINK INVALID check. Once a provisioning attempt fails, prov...