THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-10774 (LOW 2.4) — Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_key

[NVD] CVE-2026-10774 (LOW 2.4) — Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_key

mednvdPublished 2026-08-02

CVE-2026-10774 CVSS: 2.4 LOW Published: 2026-08-02T15:16:33.793

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into a PSA key slot under CONFIG_BT_MESH_PRIV_BEACONS (enabled by default), but subnet_keys_destroy() guarded the matching psa_destroy_key() with

Indicators of compromise

CVE-2026-10774cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-10774