CVE-2026-19936

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An issue exists in the Bluetooth Mesh Access-layer delayable message queue within subsys/bluetooth/mesh/delayable msg.c. The system shares three intrusive lists (busy ctx, free ctx, free chunks) and one k work delayable between two cooperative threads without proper synchronization. Specifically, bt mesh delayable msg manage() runs on the Bluetooth host RX thread, while delayable msg handler() runs on the system workqueue. Both can block while lists are in an intermediate state, allowing the other context to observe a torn state. Furthermore, delayable msg handler() uses the result of sys slist get() on busy ctx without a NULL check, and allocate delayable msg ctx() assumes sys slist get() will succeed after checking sys slist is empty().

A network member with a valid NetKey and bound AppKey can control the arrival rate and size of responses to exhaust the chunk pool. This forces the system into a purge path that can leave busy ctx empty while a delayable work item is still armed. This leads to a read-modify-write operation through a NULL-based pointer (pending msg->fired time += 10), which may abort the system workqueue thread or reset the node, resulting in a loss of availability. Additionally, this lack of synchronization can cause duplicated transmissions, duplicated send-completion callbacks, and crossed chunk ownership.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.