Zephyr OS Bluetooth Mesh Concurrent Access Vulnerability Leading to NULL Pointer Dereference (CVE-2026-19936)

Vulnerability Overview Title: Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference Description: The vulnerability resides in the Bluetooth Mesh layer's delayable message queue, specifically within . The queue shares three internal structures: , , and , which are accessed without synchronization between two cooperating threads. This specifically involves the and functions, which run in the Bluetooth host RX thread and the system work queue thread, respectively. Because and are enabled by default, responses to received Mesh messages for each model are queued through this mechanism, making enqueueing a direct consequence of inbound traffic. A peer can control inbound messages, thereby controlling delayed responses and destination addresses, and consequently controlling 4-byte context pointers and the 4-byte chunk pool. Exhausting the chunk pool forces to execute the path for sending and releasing only queued messages, leaving empty while the delayed work item remains active. The result is a read/write operation on a NULL base pointer with a fixed offset of , occurring in the system work queue thread. On typical targets, this fault causes the system work queue thread to abort, halting all work queue-driven functionalities, including Mesh timer management or node reset, which impacts node availability. The written values and addresses are fixed, with no attacker control over length or index; therefore, it cannot be used for memory corruption or code execution. This unsynchronized access also allows a message context to be selected and freed twice, leading to duplicate transmissions, duplicate completion callbacks, and crossed handle ownership. Impact Scope Affected Versions: >= 3.6.0, < 4.4.2 Fixed Version: 4.5.0 CVSS v3 Base Metrics: - Attack Vector: Adjacent - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2026-19936 Weakness: CWE-362 Remediation Status: Merged Estimated Fix Version: 4.5.0 (Merged into the branch but not yet released; verify against actual release versions) Introduced In: v175ac0 ("Bluetooth: Mesh: access tx msg randomizer"), which added , first released in v3.6.0 Fix Details: - Serialize all list mutations using (not held during blocking calls). - Make atomically detach the queue head, ensuring the sent message is no longer in the list. - Remove the unchecked from . - Discard any messages arriving at the queue head during stack suspension or reset. Evidence Multiple code snippets and call chains are provided, illustrating the specific location and trigger conditions of the vulnerability. Patch Branches: , , , Pull Requests: #113282, #116456, #116454, #116448 Status: All merged Additional Information For questions or comments, please open an issue in or email . Embargo date: 2026-10-12 --- Code Blocks Since no specific POC code or exploit code was provided on the page, no code blocks can be extracted.

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr OS Bluetooth Mesh Concurrent Access Vulnerability Leading to NULL Pointer Dereference (CVE-2026-19936)

More from this source