Bluetooth Mesh Access Layer Vulnerability in Zephyr RTOS

CVE-2026-19937

What is CVE-2026-19937?

A vulnerability in the Bluetooth Mesh Access layer of Zephyr RTOS allows a denial of service due to a flaw in the handling of message contexts. The system's static pool of message contexts becomes exhausted under specific conditions, leading to a situation where the device can no longer send responses. This is caused by a failure to return contexts to the free pool after handling delayed messages, which can result in a complete communication breakdown until the device is restarted. The error conditions can be exploited by an attacker flooding the network with requests, effectively preventing the device from processing legitimate traffic.

References