CVE-2026-10774

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description Bluetooth Mesh subnet key management fails to release a PSA Crypto key slot during subnet-key teardown. In the subsys/bluetooth/mesh/subnet.c file, the net keys create() function imports the Private Beacon Key into a PSA key slot when CONFIG BT MESH PRIV BEACONS is enabled. However, the corresponding psa destroy key() call within subnet keys destroy() was tied to a removed Kconfig symbol, rendering the destruction process inactive. This imbalance occurs during subnet deletion, Key Refresh Procedures, or node resetting and re-provisioning. An attacker with provisioner or network administrator privileges can trigger this via the Bluetooth Mesh network. Repeated cycles can exhaust the PSA key-slot pool, causing bt mesh private beacon key() and subnet creation to fail, and potentially starving other PSA crypto consumers on the device until a reboot occurs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.