CVE-2026-5589: Zephyr Bluetooth Mesh Integer Underflow and Out-of-Bounds Write

Technical summary

The vulnerability is an integer underflow in bt_mesh_sol_recv() (subsys/bluetooth/mesh/solicitation.c) triggered during BLE advertisement parsing. The function reads a length byte (reported_len) from a UUID16 AD structure without validating that reported_len >= 3 before computing reported_len - 3. In signed arithmetic, this yields a negative value. When this negative result is implicitly cast to size_t and passed to net_buf_simple_pull_mem(), it wraps to a very large positive value in unsigned context. On builds without runtime assertions, the buffer length check is bypassed, and the data pointer advances far out of bounds. Subsequent buffer operations then read or write to unmapped memory. The flaw only manifests when CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled in the Zephyr kernel configuration.

Business impact

For organizations deploying Zephyr-based IoT and embedded devices with Bluetooth Mesh in privacy-sensitive roles (such as private proxy servers), this vulnerability exposes systems to remote denial of service and potential code execution without authentication. Medical devices, industrial sensors, smart building controllers, and other mesh-networked endpoints could be remotely crashed or compromised from a nearby attacker position. Recovery and diagnostics become difficult in distributed mesh networks, and widespread exploitation could disrupt critical infrastructure that relies on mesh coordination. Unpatched fleets present a material availability and integrity risk.

Affected systems

Zephyr RTOS deployments with Bluetooth Mesh support and CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled are directly affected. This includes custom SoCs and third-party modules built on Zephyr, as well as development boards commonly used in research and prototype mesh networks. Devices that participate in Bluetooth Mesh networks in the private proxy server role are at highest risk. Systems without CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled are not exploitable via this path, though they may still run vulnerable code if the feature is compiled in but disabled at runtime—verify your configuration.

Exploitability

Exploitability is straightforward. An attacker within BLE range (~10–100 meters depending on antenna and power) can craft a non-connectable BLE advertisement with a malformed UUID16 AD structure and transmit it repeatedly. No pairing, bonding, or prior association is required. Standard BLE advertising tools can generate the malicious payload. The attack is reliable and repeatable, though achieving code execution (rather than denial of service) requires knowledge of the target device's memory layout and may be mitigated by ASLR or MPU settings on some platforms. Access vector is network (adjacent network for BLE), privileges are not required, user interaction is not needed, and the scope is unchanged—satisfying the CVSS 3.1 vector for a MEDIUM rating.

Remediation

Apply a patch to Zephyr that adds bounds checking in bt_mesh_sol_recv() before the integer arithmetic. The fix must validate reported_len >= 3 before subtracting 3, and should use unsigned arithmetic or explicit type casts to prevent signed-to-unsigned conversion surprises. Disable CONFIG_BT_MESH_OD_PRIV_PROXY_SRV in production kernels if the private proxy server role is not required. Rebuild and reflash affected devices with the corrected kernel. Verify the fix in your prerelease testing by attempting to send malformed solicitation advertisements to confirm they are rejected or logged without memory corruption.

Patch guidance

Consult the official Zephyr security advisory and the Zephyr GitHub repository (github.com/zephyrproject-rtos) for the specific patched version number and commit hash. Patches will likely be backported to multiple long-term support (LTS) branches. Update your Zephyr SDK and west tool, then run 'west update' to pull the fixed source. Rebuild your application with 'west build -b <your_board> --pristine' to ensure the old object files are not reused. Test the patched build on representative hardware before production deployment. If you maintain a fork of Zephyr, cherry-pick the fix commit into your branches and re-test your application.

Detection guidance

Monitor system logs and kernel messages for memory faults (segfaults, data aborts) or watchdog resets that correlate with BLE activity, especially on private proxy server instances. Enable Zephyr kernel logging with CONFIG_BT_MESH_DEBUG_SOLICITATION if available. In firmware images with assertions enabled, watch for assertion failures in the solicitation path. On systems with crash dumps enabled, analyze dumps for stack traces pointing to bt_mesh_sol_recv() or nearby functions. Network-level detection is difficult but possible if you can capture and analyze raw BLE advertisement frames; look for UUID16 AD structures with length values less than 3. Host-based behavior monitoring (e.g., unexpected reboots, service interruptions in mesh-dependent processes) is a useful trigger for investigation.

Why prioritize this

This vulnerability warrants moderate-to-high priority patching. While the CVSS score of 6.3 is MEDIUM, the low barrier to exploitation, lack of authentication requirement, and potential for code execution on critical infrastructure mesh nodes elevate practical risk. Organizations with wide BLE Mesh deployments (smart buildings, industrial IoT, medical sensor networks) should prioritize patching within 30–60 days. However, if CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is not enabled in your kernel configuration, remediation can be deferred, provided your inventory is well-documented. Verify your configuration across all builds immediately.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a MEDIUM severity. Attack vector is network-adjacent (BLE), attack complexity is low, no privileges or user interaction are required, and the impact is confidentiality, integrity, and availability—each rated as low in the vector. The relatively low individual impact ratings (rather than high or critical) keep the overall score in the MEDIUM band, but this is somewhat conservative given that code execution on mesh infrastructure could cascade. Organizations managing critical mesh deployments should treat this as a higher practical priority than the numeric score suggests.

Frequently asked questions