CVE-2026-5589: Integer Underflow in Zephyr Bluetooth Mesh Solicitation Handling

Technical summary

CVE-2026-5589 is an integer underflow vulnerability in bt_mesh_sol_recv() (subsys/bluetooth/mesh/solicitation.c) that occurs when CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled. The function parses solicitation PDUs from BLE advertising payloads and reads an attacker-controlled length byte (reported_len) without validating that reported_len >= 3 before computing reported_len - 3. In signed integer arithmetic, this underflow produces a negative value that bypasses the length guard. When the negative value is implicitly cast to size_t and passed to net_buf_simple_pull_mem(), it becomes a very large positive integer due to two's complement wrapping. This causes the buffer pointer to advance far out of bounds, enabling out-of-bounds reads and writes in subsequent operations. Builds without compile-time assertions are particularly vulnerable.

Business impact

Organizations deploying Zephyr-based Bluetooth Mesh devices—including IoT gateways, mesh routers, and sensors—face denial-of-service risk from remote attackers within broadcast range. If arbitrary code execution is achievable through carefully crafted payloads, compromised devices could be reprogrammed or used as network pivots. This affects supply chains reliant on mesh-based industrial automation, building management, or smart home systems. The lack of authentication requirements means threat actors do not need to compromise pairing credentials or network keys.

Affected systems

Zephyr Project versions that include the affected solicitation.c code with CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled are susceptible. This configuration is not necessarily default, but products enabling Bluetooth Mesh proxy functionality for network extension are at risk. Specific affected version ranges should be verified against the Zephyr security advisory and product documentation from device manufacturers integrating Zephyr.

Exploitability

Exploitability is straightforward. An attacker with a standard BLE radio adapter (widely available) can craft a non-connectable advertisement containing a UUID16 AD structure with a malformed length byte. No pairing, authentication, or proximity beyond typical BLE range (~100m in open space) is needed. The attack is deterministic—sending the malicious packet reliably triggers the underflow. Post-exploitation impact depends on memory layout and whether assertions are disabled; some targets may crash (DoS), while others might allow code execution.

Remediation

Upgrade Zephyr to a patched version that validates reported_len >= 3 before performing the subtraction. Verify the exact patch version in the official Zephyr security advisory. Organizations unable to update immediately should disable CONFIG_BT_MESH_OD_PRIV_PROXY_SRV if the proxy server role is not essential, or restrict BLE advertising reception to known, trusted devices via hardware or firmware filtering if feasible.

Patch guidance

Consult the Zephyr Project security advisory for the specific patched version. Patches typically involve adding a bounds check on reported_len before the arithmetic operation. After patching, rebuild and reflash affected devices. If devices are deployed in the field without OTA capability, coordinate a staged firmware update with stakeholders. Test patches in a lab environment with Bluetooth Mesh devices to confirm proxy functionality remains intact post-update.

Detection guidance

Intrusion detection systems monitoring BLE traffic can be tuned to flag advertisements with UUID16 AD structures bearing suspiciously small length values (less than 3 bytes). Zephyr applications can enable compile-time assertions (CONFIG_ASSERT or equivalent) to catch the underflow and reboot safely rather than silently corrupt memory. Monitor system logs and crash reports for unexplained device reboots or hangs in Bluetooth Mesh-enabled products. Network operators should baseline normal mesh advertisement patterns and alert on anomalies.

Why prioritize this

Although assigned MEDIUM severity (CVSS 6.3), this warrants prompt attention because exploitation requires no authentication, is remotely triggered, and impacts foundational mesh infrastructure. The potential for arbitrary code execution and the widespread use of Zephyr in unattended IoT deployments elevate practical risk. Prioritize patching devices in critical infrastructure or high-density mesh networks first.

Risk score, explained

CVSS 3.1 score of 6.3 reflects network-based attack vector (AV:N), low attack complexity (AC:L), and low privilege requirement (PR:L). The PR:L requirement assumes some prior association or network access; however, the vulnerability is triggered by unauthenticated BLE broadcasts, which may warrant re-evaluation in organizational risk models. The impact is limited (C:L/I:L/A:L) in the CVSS model, but memory corruption vulnerabilities carry inherent code execution risk not fully captured by the base score.

Frequently asked questions