CVE-2026-15894

Executive Summary

CVE-2026-15894 is a stack-based buffer overflow (CWE-121) in the Zephyr RTOS Bluetooth Mesh On-Demand Private Proxy solicitation handler, located in subsys/bluetooth/mesh/solicitation.c. When the mesh scan callback in subsys/bluetooth/mesh/adv.c invokes net_buf_simple_restore() before dispatching to bt_mesh_sol_recv(), the buffer length reflects the entire remaining advertising payload rather than the Solicitation Service Data, allowing an unauthenticated attacker within radio range to supply a length greater than 17 and overflow a 17-byte stack buffer during sol_pdu_decrypt(). Successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:A/AC:L/PR:N/UI:N), and no key material is required to trigger the overflow, as the copy precedes any decryption or authentication.

Technical Analysis

The vulnerability resides in the Bluetooth Mesh On-Demand Private Proxy solicitation handling path. Two code paths interact to produce the flaw:

Buffer allocation. In sol_pdu_decrypt(), the destination buffer out is declared as NET_BUF_SIMPLE(17) — a fixed 17-byte stack buffer sized for a Solicitation PDU.

Unbounded copy. The buffer is populated via net_buf_simple_add_mem(out, in->data, in->len). The helper net_buf_simple_add() enforces tailroom only with __ASSERT_NO_MSG, which is a no-op in production builds (assertions compiled out). Consequently, when in->len > 17, the underlying memcpy writes attacker-controlled bytes past the end of the 17-byte stack buffer. This is the direct CWE-121 defect.

Root cause of oversized in->len. The length anomaly originates upstream in the mesh scan callback in subsys/bluetooth/mesh/adv.c, which calls net_buf_simple_restore() before dispatching to bt_mesh_sol_recv(). This restores buf->len to cover the entire remaining advertising payload rather than only the Solicitation Service Data. After the parser locates the Service Data AD and consumes the Identification Type byte, the residual buf->len equals the 17-octet Network PDU plus any trailing advertising bytes. Prior to this fix, only a minimum-length check existed — there was no maximum-length check — so an attacker can append extra AD structures or padding after the Solicitation Service Data to force buf->len above 17.

Attack surface. bt_mesh_scan_cb() is registered directly as the BLE scan callback, so buf consists of raw, unauthenticated over-the-air advertising data. Any device in radio range can transmit a crafted non-connectable advertising packet containing a Solicitation Service Data AD whose trailing length exceeds the 17-byte destination. Because the copy occurs before any decryption or authentication, no key material and no authentication are required to trigger the overflow. The vulnerability class is a classic unauthenticated over-the-air stack buffer overflow; exploitation primitives (control-flow hijack versus denial of service) depend on target layout and build configuration, which are not specified in the available advisory data.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-15894; the attack chain below is inferred from the vulnerability class and the technical details disclosed in the NVD description.

1. Reconnaissance / target identification. The attacker positions a BLE-capable radio (e.g., a commodity BLE adapter or a device capable of emitting raw advertising PDUs) within radio range of a target running a vulnerable Zephyr-based Bluetooth Mesh stack that has On-Demand Private Proxy solicitation enabled. No prior authentication, pairing, or key exchange with the target is required; the attacker only needs the ability to transmit advertising packets.

2. Triggering the flaw. The attacker crafts a non-connectable advertising PDU containing a Solicitation Service Data AD. After the Identification Type byte, the attacker appends additional AD structures or padding so that the residual buf->len seen by the parser exceeds 17. When the scan callback restores the buffer length and dispatches to bt_mesh_sol_recv(), sol_pdu_decrypt() receives in with in->len > 17.

3. Payload / execution method. The byte content immediately following the valid 17-octet region is attacker-controlled via in->data. net_buf_simple_add_mem(out, in->data, in->len) copies all in->len bytes into the fixed 17-byte stack buffer out. In production builds the __ASSERT_NO_MSG tailroom guard does not fire, so bytes beyond offset 17 overwrite adjacent stack memory. The copy occurs before any decryption or authentication, meaning no valid network key or application key is needed, and the overflow is performed on raw mesh network PDU bytes controlled by the attacker.

4. Post-exploitation impact. Depending on the stack layout of the affected build, overwriting adjacent stack memory can corrupt control data and lead to memory corruption with potential code execution, or to a crash/denial of service of the Bluetooth Mesh node. The CVSS 3.1 vector (C:H/I:H/A:H, S:U) reflects high confidentiality, integrity, and availability impact within the same security scope. Because the overflow pre-dates authentication, the flaw also bypasses the intended security boundary of the On-Demand Private Proxy solicitation handshake.

Impact Assessment

CVE-2026-15894 carries a CVSS 3.1 base score of 8.8 (High), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:

• AV:A (Adjacent) — exploitation requires only radio adjacency (BLE range), not network or internet foothold.
• AC:L (Low) — no special conditions are required beyond transmitting a crafted advertising packet.
• PR:N / UI:N — no privileges and no user interaction.
• S:U (Unchanged) — impact is confined to the vulnerable component.
• C:H/I:H/A:H — high confidentiality, integrity, and availability impact (memory corruption with possible code execution or device crash).

Affected systems. Zephyr RTOS-based Bluetooth Mesh devices that enable the On-Demand Private Proxy feature (the subsys/bluetooth/mesh/solicitation.c path). This class of stack is common in low-power mesh lighting, building automation, sensor networks, and industrial control endpoints. Because the scan callback receives raw over-the-air advertising, every in-range node that scans is potentially reachable.

Blast radius. Any single in-range attacker can attempt the overflow against every vulnerable node in radio range, yielding potential compromise of entire mesh fleets or, at minimum, widespread node crashes/denial of service. No EPSS value is assigned (not yet scored by FIRST.org) and the CVE is not listed in CISA KEV — no evidence of in-the-wild exploitation is currently available.

Detection Guidance

Detection for this over-the-air memory-corruption flaw centers on BLE advertising packet inspection (oversized Solicitation Service Data ADs) and on device-side crash/restart telemetry. Note: because the flaw is triggered on raw BLE advertising, host-based rules are complementary and by nature heuristic.

Sigma Rule

title: Zephyr Bluetooth Mesh Solicitation PDU Buffer Overflow Attempt
id: 3f9c1a72-1589-4e26-9b54-zephyr-sol-bof
status: experimental
description: Detects anomalous BLE mesh solicitation handling or crash/restart telemetry consistent with CVE-2026-15894 (CWE-121 stack overflow in sol_pdu_decrypt).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15894
author: SOC Detection Engineering
date: 2026/01/01
logsource:
  category: application
  product: zephyr
  service: bluetooth_mesh
detection:
  selection_crash:
    EventID:
      - 'MESH_SOL_RECV'
      - 'MESH_SOL_PDU'
    Message|contains:
      - 'sol_pdu_decrypt'
      - 'stack'
      - 'fault'
      - 'hardfault'
  selection_len:
    Message|contains: 'Solicitation'
  condition: selection_crash and selection_len
falsepositives:
  - Legitimate over-sized but valid advertising frames (unlikely by spec)
  - Firmware debug builds where assertions are enabled
level: high

YARA Rule

rule CVE_2026_15894_Zephyr_Mesh_Solicitation_BOF
{
    meta:
        author = "SOC Detection Engineering"
        description = "Detects vulnerable Zephyr Bluetooth Mesh solicitation handling patterns related to CVE-2026-15894"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-15894"
        cve = "CVE-2026-15894"
        date = "2026-01-01"
    strings:
        $s1 = "sol_pdu_decrypt" ascii
        $s2 = "net_buf_simple_add_mem" ascii
        $s3 = "bt_mesh_sol_recv" ascii
        $s4 = "NET_BUF_SIMPLE(17)" ascii
        $s5 = "solicitation.c" ascii
    condition:
        uint32(0) == 0x464C457F and any of ($s*) or 2 of ($s*)
}

Suricata IDS Rule

alert udp any any -> any 1900 (msg:"CVE-2026-15894 Zephyr Bluetooth Mesh Solicitation oversized PDU attempt"; flow:stateless; content:"|00 00|"; classtype:attempted-admin; reference:cve,2026-15894; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-15894; sid:202615894; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : ("zephyr", "mesh", "bt_mesh") and
  process.args : "*solicitation*"

Splunk SPL Query

index=zephyr OR index=iot sourcetype=bluetooth:mesh
| search ("sol_pdu_decrypt" OR "bt_mesh_sol_recv" OR "Solicitation")
| stats count min(_time) as first_seen max(_time) as last_seen by host, Message
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="zephyr,bluetooth_mesh,">
  <rule id="100158" level="12">
    <decoded_as>zephyr-mesh</decoded_as>
    <match>sol_pdu_decrypt|bt_mesh_sol_recv|Solicitation</match>
    <description>CVE-2026-15894: Zephyr Bluetooth Mesh solicitation PDU buffer overflow/crash detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_15894,memory_corruption,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is currently published.

1. Immediate mitigations

   • Disable the Bluetooth Mesh On-Demand Private Proxy solicitation feature if it is not operationally required (if the build supports compiling it out of subsys/bluetooth/mesh/solicitation.c).
   • Where the feature must remain enabled, restrict mesh scanning/radio exposure and physically isolate mesh nodes from unmanaged radio environments where feasible.
   • Monitor mesh nodes for unexpected resets, HardFaults, or watchdog reboots, which may indicate overflow attempts.
   • Enable link-layer security where the deployment profile allows, though note that the flaw triggers before decryption/authentication, so link-layer controls do not prevent the overflow itself.

2. Patch / upgrade steps

   • Track the upstream Zephyr project (subsys/bluetooth/mesh/solicitation.c, subsys/bluetooth/mesh/adv.c) for a fix that adds a maximum-length check on the solicitation buffer before net_buf_simple_add_mem() and/or corrects the net_buf_simple_restore() ordering in the scan callback.
   • Because no patched release is identified, verify the fix independently and rebuild firmware from a corrected source tree rather than relying on a version string alone.
   • Inventory all Zephyr-based mesh firmware in the environment and identify builds that enable On-Demand Private Proxy.

3. Long-term hardening

   • Eliminate reliance on __ASSERT_NO_MSG for bounds enforcement in production builds; use always-on length validation before any net_buf_simple_add_mem() copy.
   • Adopt defensive coding for all NET_BUF_SIMPLE(N) stack buffers receiving external data: validate in->len <= N unconditionally.
   • Add fuzzing / protocol-mutation testing of the BLE advertising parser and solicitation handler.
   • Implement runtime memory protections (stack canaries, MPU-based stack guards where the Zephyr target supports them).

References

• NVD — CVE-2026-15894: https://nvd.nist.gov/vuln/detail/CVE-2026-15894
• MITRE CWE-121 (Stack-based Buffer Overflow): https://cwe.mitre.org/data/definitions/121.html
• Zephyr Project security / Bluetooth Mesh subsystem source (subsys/bluetooth/mesh/solicitation.c, subsys/bluetooth/mesh/adv.c): https://github.com/zephyrproject-rtos/zephyr
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-15894 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score assigned as of report generation): https://www.first.org/epss/
• No public PoC, exploit code, Nuclei template, or known threat actor campaign identified for CVE-2026-15894 at the time of writing.