The flaw resides in Zephyr’s Bluetooth Mesh PB‑ADV provisioning bearer; prov_msg_recv() resets the provisioning watchdog timer before verifying if the link has been invalidated. When a provisioning attempt fails, prov_failed() marks the link as invalid, but each subsequent packet still restarts the timer, preventing the timeout that would normally close the link. As a result, the device remains locked in an un‑provisionable state: its unprovisioned beacon is turned off and all new provisioning requests are denied. No memory corruption, data leak, or integrity breach occurs; the sole effect is a persistent denial of the provisioning/re‑provisioning service, which is equivalent to a device‑level DoS.

Zephyr RTOS versions up to and including 4.4.1 are vulnerable. Any Zephyr deployment that has Bluetooth Mesh enabled and the PB‑ADV provisioning bearer active is at risk. The vulnerability does not affect systems that do not use the Bluetooth Mesh PB‑ADV bearer.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% and absence from CISA KEV suggest a low likelihood of widespread exploitation. An attacker only needs to transmit crafted PB‑ADV PDUs over the BLE advertising channel; by sending packets more frequently than the 60‑second (or 120‑second for OOB) timeout, the attacker keeps the invalidated link alive indefinitely. The attack vector requires no prior pairing or trust and relies on the lack of authentication for PB‑ADV PDUs. The issue persists until a provisioning timeout fires, which will close the link once the vendor’s fix is applied.