CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

CVE-2026-19937

The Bluetooth Mesh Access layer in Zephyr RTOS (specifically subsys/bluetooth/mesh/delayable_msg.c) contains a resource leak vulnerability. The bt_mesh_delayable_msg_manage() function fails to correctly re-insert a message context into the pool during a chunk-exhaustion error path, causing the co...

CVE-2026-19937 Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

CVE-2026-19936 Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

PT-2026-111112

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable msg.c manages a static pool of CONFIG BT MESH ACCESS DELAYABLE MSG COUNT message contexts default 4 threaded onto a free ctx or busy ctx list. release delayable msg ctx returned a context to free ctx on...