CVE-2026-19936 zephyrproject CVE debrief

Who should care

Bluetooth Mesh Access-layer delayable message queue users and administrators, including operators, platform maintainers, vulnerability management teams, and security teams who need to assess and mitigate the impact of this vulnerability on their systems and networks.

Why it matters

A vulnerability in the Bluetooth Mesh Access-layer delayable message queue allows a remote attacker to cause a denial of service (DoS) due to improper synchronization between two cooperative threads.

• Denial of Service (DoS) due to system workqueue thread crash
• Potential NULL pointer dereference
• Crash of the system workqueue thread

Technical summary

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronization: bt_mesh_delayable_msg_manage() runs on the Bluetooth host RX thread, while delayable_msg_handler() runs on the system workqueue. Both block while the lists are in an intermediate state — the enqueuer in bt_rand(), both in bt_mesh_access_send() — which lets the other context observe torn state.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to fix the vulnerability
• Ensure that the Bluetooth Mesh Access-layer delayable message queue is properly synchronized
• Monitor the system workqueue thread for potential crashes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a lack of synchronization between two cooperative threads, bt_mesh_delayable_msg_manage() and delayable_msg_handler(), which share three intrusive lists and one k_work_delayable. This leads to a potential NULL pointer dereference and a crash of the system workqueue thread.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.