Bluetooth Mesh Access-layer Message Queue Vulnerability in Zephyr RTOS

CVE-2026-19936

What is CVE-2026-19936?

A vulnerability exists in the Bluetooth Mesh Access-layer message queue of the Zephyr RTOS, where multiple cooperative threads access shared lists without synchronization. This lack of proper handling can lead to stalled messages and potential availability issues for affected nodes. A peer with access to Layer messages can control message rates, which leads to the exhaustion of the context pool. The failure to manage these concurrent access issues may result in system crashes or node resets, disrupting normal functionality. The vulnerability has been addressed by implementing synchronization mechanisms to ensure safe concurrent access.

References