Skip to content
Heist/ feed
Medium

Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses

Type: advisorySource: Official CVE List1 source record

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT message contexts (default 4) threaded onto a free_ctx or busy_ctx list. release_delayable_msg_ctx() returned a context to free_ctx only when sys_slist_find_and_remove() found it on busy_ctx. The chunk-exhaustion error path in bt_mesh_delayable_msg_manage() releases a context that was already popped off free_ctx but not yet inserted on busy_ctx, so the context was appended to neither list and was permanently lost from the pool. Because bt_mesh_delayable_msg_init() runs only once from bt_mesh_init(), and node reset/suspend only drain busy_ctx, the loss survives unprovision, re-provision and suspend/resume — it is cleared only by a reboot. The error path is reached when the chunk pool (CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CHUNK_COUNT, default 40 chunks) is short of the chunks a new delayed message needs and the oldest pending message cannot be flushed because bt_mesh_access_send() returns -EBUSY or -ENOBUFS (all segmented-TX contexts busy, or advertising/segment buffers exhausted). A peer that is provisioned into the mesh network — holding a valid NetKey plus an AppKey or DevKey bound to a server model — can drive both conditions by flooding the victim with requests that elicit segmented responses while withholding the Segment Acknowledgment, which keeps the transmit contexts occupied while queued responses hold th

Announced Group revision 1
Original source ↗

CVE-2026-19937

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-19937

zephyr

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "zephyrproject",
    "product": "zephyr",
    "versions": [
      {
        "status": "affected",
        "version": "3.6.0",
        "versionType": "semver",
        "lessThanOrEqual": "4.4.2"
      }
    ],
    "packageName": "zephyr",
    "programFiles": [
      "subsys/bluetooth/mesh/delayable_msg.c"
    ],
    "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "bt_mesh_delayable_msg_manage"
      },
      {
        "name": "release_delayable_msg_ctx"
      }
    ]
  }
]
Related CVEs
CVE-2026-19937

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#23042 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement