Zephyr RTOS CVE-2026-19936

Requires both CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG and CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CTX_ENABLED (both default to 'y', so stock builds are affected) and a model that generates responses to inbound mesh messages. The attacker must be a provisioned, credentialed mesh network member - holding the NetKey and a bound AppKey - within Bluetooth radio range (Adjacent), able to control arrival rate, response size, and destination address to exhaust the 4-entry context pool and 40-entry chunk pool and drive the purge path. Limiting factors: valid mesh credentials are mandatory (PR:L, rules out anonymous attackers), physical/radio proximity is required (AV:A), and exploitation hinges on winning a narrow unsynchronized race where the enqueuer yields while busy_ctx is empty (AC:H), making reliable triggering non-trivial.

This is a medium-severity, availability-only issue (CVSS 4.8, CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) and the signals are internally consistent rather than conflicting. The attack vector is Adjacent (AV:A), i.e. Bluetooth radio range, not the Internet, and attack complexity is High (AC:H) because success depends on winning an unsynchronized race window between the RX thread and the system workqueue. Privileges Required is Low (PR:L), which the description substantiates concretely: the attacker must be a provisioned mesh member holding the NetKey and a bound AppKey, so this is an insider/compromised-member threat, not an anonymous one. Impact is confined to availability (A:H) - node crash or reset - with the description explicitly stating no confidentiality or integrity impact and no path to memory corruption or code execution. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input; a patch is available from the vendor. Exploitation status: no public exploit identified at time of analysis. Net: a real but lower-priority defense-in-depth fix, not an urgent widespread threat. NOTE: the input Tags 'RCE' and 'Buffer Overflow' directly contradict the description (CWE-362 race condition causing a fixed NULL-pointer write), and should not drive prioritization.

A provisioned mesh node within Bluetooth range - a legitimate member or a compromised one holding the NetKey and a bound AppKey - streams crafted access-layer messages that elicit model responses, exhausting the 40-entry chunk pool to force bt_mesh_delayable_msg_manage() down the purge path and leave busy_ctx empty while the delayable work item is still armed. If the enqueuer then yields at the wrong moment, the system-workqueue handler dereferences a NULL list entry (pending_msg->fired_time += 10), faulting and aborting the workqueue thread or resetting the node. No public exploit identified at time of analysis; exploitation also requires winning a narrow timing race (AC:H).