In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer, the function prov_msg_recv() reschedules the provisioning protocol watchdog timer unconditionally before performing critical checks such as the FCS and ADV_LINK_INVALID status. An attacker can induce a provisioning failure to set ADV_LINK_INVALID and then send valid FCS PB-ADV PDUs more frequently than the protocol timeout interval, preventing the timer from firing and thus blocking the recovery path. This causes the device to remain in a dead link state with its unprovisioned beacon disabled and rejects new provisioning link requests, resulting in a persistent denial of provisioning service. The vulnerability affects releases through v4.4.1, including 3.5.0. The fix involves moving the timer reschedule to after the ADV_LINK_INVALID and FCS checks to prevent invalidated links from being kept alive by incoming packets.

The vulnerability allows a remote, unauthenticated attacker on the BLE advertising channel to cause a persistent denial of provisioning or re-provisioning service on affected Zephyr devices. The attacker does not need pairing or prior trust and can select the link ID arbitrarily. There is no impact on memory safety, confidentiality, or integrity. The denial of service affects device provisioning functionality, potentially preventing device setup or recovery.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that moves the timer reschedule to after the ADV_LINK_INVALID and FCS checks, but no official patch or advisory link is provided in the data. Until a patch is available, consider restricting BLE advertising channel access or monitoring for abnormal provisioning attempts if feasible.