CVE-2026-19937

Executive Summary

CVE-2026-19937 is a resource-leak vulnerability in the Zephyr RTOS Bluetooth Mesh Access layer (subsys/bluetooth/mesh/delayable_msg.c) that permanently removes a message context from a fixed private pool whenever a specific error path in bt_mesh_delayable_msg_manage() is taken. A provisioned peer that floods the victim node with requests requiring segmented responses while withholding Segment Acknowledgments can exhaust the delayable-message context pool, causing irreversible degradation of the node's ability to process delayed Mesh Access messages. The defect survives unprovision, re-provision, and suspend/resume cycles, and is only cleared by a full reboot.

Technical Analysis

The Bluetooth Mesh Access layer implements a delayable-message mechanism in subsys/bluetooth/mesh/delayable_msg.c. It manages a statically allocated pool of message contexts sized by CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT (default: 4). Each context is threaded onto one of two singly-linked lists: free_ctx (available) or busy_ctx (in use). A separate chunk pool sized by CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CHUNK_COUNT (default: 40 chunks) provides backing storage for the payloads of pending delayed messages.

The helper function release_delayable_msg_ctx() returns a context to free_ctx only when sys_slist_find_and_remove() successfully finds that context on busy_ctx. This logic assumes every context being released is currently linked on busy_ctx. That assumption is violated by one specific error path.

In bt_mesh_delayable_msg_manage(), when a new delayed message cannot be allocated because the chunk pool is short of the chunks it requires, the code attempts to free space by flushing the oldest pending message. Flushing calls bt_mesh_access_send(). If bt_mesh_access_send() returns -EBUSY or -ENOBUFS — which occurs when all segmented-TX contexts are busy or when advertising/segment buffers are exhausted — the flush fails. In that failure path, the function releases the context it had just popped off free_ctx but not yet inserted onto busy_ctx. Because release_delayable_msg_ctx() only returns a context to free_ctx when sys_slist_find_and_remove() locates it on busy_ctx, and this context is on neither list, the context is appended to neither list. It is permanently lost from the pool.

The consequence is a monotonic, non-recoverable leak. bt_mesh_delayable_msg_init() runs exactly once, from bt_mesh_init(). Node reset and node suspend operations only drain busy_ctx; they do not rebuild the pool. Therefore each occurrence of the error path permanently reduces the effective delayable-message capacity. Once all contexts have been lost, the node can no longer queue delayed Access messages, permanently degrading its Mesh model behavior. The condition is cleared only by rebooting the device.

Root cause class: CWE-772 (Missing Release of Resource after Effective Lifetime) — specifically, a resource (message context) is removed from its managing pool and is never returned on a specific error path.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the described vulnerability class and the trigger conditions stated in the NVD description.

1. Reconnaissance / target identification: The attacker must already be a member of the same Bluetooth Mesh network as the victim — that is, the peer that drives the condition is "provisioned into the mesh network." It must hold a valid NetKey plus an AppKey or DevKey bound to a server model on the target node. This implies the adversary is either a trusted node in the mesh or a node that has obtained network and application credentials through other means.

2. Triggering the leak condition: The attacker sends requests to the victim's server model that elicit segmented responses (responses large enough to require segmented transport). The attacker deliberately withholds the Segment Acknowledgment. Withholding the Segment Acknowledgment holds the victim's segmented-TX contexts occupied, which is a prerequisite for bt_mesh_access_send() to return -EBUSY when the delayed-message machinery tries to flush the oldest pending message. Concurrently, the attacker floods enough requests/responses to exhaust the delayable-message chunk pool (CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CHUNK_COUNT), causing a new delayed message to fail its chunk allocation and reach the chunk-exhaustion error path.

3. Execution / leak accumulation: On each iteration where the chunk pool is short AND the flush of the oldest pending message fails with -EBUSY or -ENOBUFS, the context popped from free_ctx is returned to neither list and is lost. Repeated attack cycles drive the count of lost contexts upward. Because the pool defaults to four contexts, only a small number of successful triggering iterations are required to exhaust it.

4. Post-exploitation impact: With all delayable-message contexts lost from the pool, the node can no longer queue delayable Access messages. The loss persists across unprovision, re-provision, and suspend/resume, so clearing and re-adding the node does not restore function. Only a reboot clears the condition. The net effect is a sustained, low-effort denial of service against the affected Mesh node's delayable Access message processing.

No published exploit code, Nuclei template, or known in-the-wild campaign was identified for this CVE at time of writing.

Impact Assessment

• CVSS 3.1 base score: 5.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
• Attack Vector — Adjacent (AV:A): the attacker must be within Bluetooth radio range and be a provisioned member of the same mesh network.
• Attack Complexity — Low (AC:L): once provisioned, triggering requires no special conditions beyond flooding requests and withholding acknowledgments.
• Privileges Required — Low (PR:L): the attacker needs valid network credentials and a key bound to a server model; it is a legitimate network participant, not an anonymous outsider.
• User Interaction — None (UI:N): no victim user action is required.
• Scope — Unchanged (S:U): impact is confined to the vulnerable node.
• Confidentiality — None (C:N), Integrity — None (I:N): the flaw does not disclose or modify data.
• Availability — High (A:H): loss of the delayable-message context pool irreversibly degrades the node's Access-layer message handling until reboot.

Business impact: affected Bluetooth Mesh nodes — lighting, building automation, sensor/actuator endpoints, and similar constrained devices running Zephyr RTOS — can be persistently degraded by any provisioned peer. Because the exhaustion is not cleared by unprovision/re-provision/suspend, operational recovery requires a node reboot, which may be disruptive in large mesh deployments. Blast radius is limited to the individual targeted node (Scope: Unchanged), but the low interaction cost means many nodes could be targeted sequentially.

Detection Guidance

Sigma Rule

title: Potential Bluetooth Mesh Delayable Message Context Exhaustion Attempt
id: 8f3c1a72-0b6d-4e51-9c2a-7d5e9b1a4f60
status: experimental
description: Detects signs of a peer withholding Segment Acknowledgments while flooding requests that elicit segmented responses, consistent with CVE-2026-19937 resource-leak triggering.
logsource:
  product: linux
  service: kernel
detection:
  selection_ebusy:
    message|contains:
      - 'bt_mesh_access_send'
      - 'delayable_msg_manage'
      - 'EBUSY'
      - 'ENOBUFS'
  selection_segack:
    bluetooth_mesh_event:
      - 'segment_ack_timeout'
      - 'seg_tx_busy'
  condition: selection_ebusy or selection_segack
level: medium
tags:
  - attack.t1499
  - cve.2026.19937

YARA Rule

rule CVE_2026_19937_Zephyr_Mesh_DelayableMsg_Leak
{
    meta:
        description = "Detects Zephyr Bluetooth Mesh delayable message context leak indicators in firmware strings"
        cve = "CVE-2026-19937"
        cwe = "CWE-772"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19937"
        confidence = "medium"
    strings:
        $s1 = "bt_mesh_delayable_msg_manage" ascii
        $s2 = "release_delayable_msg_ctx" ascii
        $s3 = "CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT" ascii
        $s4 = "CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CHUNK_COUNT" ascii
        $s5 = "delayable_msg.c" ascii
    condition:
        any of ($s*)
}

Suricata IDS Rule

alert bluetooth any any -> any any (msg:"CVE-2026-19937 Possible Bluetooth Mesh Delayable Msg Context Exhaustion Attempt"; flow:to_server; content:"|02|"; depth:1; classtype:attempted-dos; reference:cve,2026-19937; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19937; sid:202619937; rev:1;)

Elastic Detection

sequence by host.id with maxspan=60s
  [ log where event.category == "network" and
      network.protocol == "bluetooth" and
      bluetooth.mesh.event == "segment_ack_timeout" ]
  [ log where event.category == "network" and
      network.protocol == "bluetooth" and
      bluetooth.mesh.event == "seg_tx_busy" ]

Splunk SPL Query

index=mesh_bt_logs (message="bt_mesh_delayable_msg_manage" OR message="bt_mesh_access_send") (message="EBUSY" OR message="ENOBUFS")
| stats count AS trigger_events, dc(node_id) AS affected_nodes BY src_addr, node_id
| where trigger_events > 3
| sort - trigger_events

Wazuh OSSEC Rule

<group name="bluetooth_mesh,cve_2026_19937,">
  <rule id="2026937" level="8">
    <decoded_as>syslog</decoded_as>
    <match>bt_mesh_delayable_msg_manage|bt_mesh_access_send</match>
    <regex>EBUSY|ENOBUFS</regex>
    <description>CVE-2026-19937: Possible Bluetooth Mesh delayable message context leak / context exhaustion attempt.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,cve_2026_19937,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict which nodes may be provisioned into the mesh network; the attack requires a provisioned peer holding a valid NetKey plus an AppKey or DevKey bound to a server model. Limiting provisioning to trusted devices removes the attacker's prerequisite.
• Monitor for repeated bt_mesh_access_send() failures returning -EBUSY/-ENOBUFS correlated with withheld Segment Acknowledgments; this pattern precedes the leak.
• Where operationally acceptable, reboot affected nodes as a clearing action, since the lost contexts are recoverable only by reboot.
• Reduce exposure by minimizing server-model instances that elicit segmented responses on nodes that process delayable Access messages.

2. Patch/upgrade steps:

• No vendor fix is available from any tracked source. Track the Zephyr project's subsys/bluetooth/mesh/delayable_msg.c history for a fix that ensures the context popped from free_ctx is returned to free_ctx on the chunk-exhaustion error path even when it was never inserted onto busy_ctx.
• Apply the upstream fix once released and re-verify that release_delayable_msg_ctx() behavior matches context list state on all error paths.

3. Long-term hardening:

• Reduce reliance on default pool sizes and audit all error paths that manipulate free_ctx/busy_ctx for symmetry of add/remove operations.
• Add instrumentation or assertions that detect a context present on neither list (pool accounting invariant) so future leaks fail loudly at development time.
• Ensure node reset/suspend routines rebuild or validate the delayable-message pool rather than only draining busy_ctx.
• Segment large mesh deployments to limit the reach of any single misbehaving provisioned peer.

References

• NVD — CVE-2026-19937: https://nvd.nist.gov/vuln/detail/CVE-2026-19937
• CWE-772 Missing Release of Resource after Effective Lifetime: https://cwe.mitre.org/data/definitions/772.html
• Zephyr Project source: subsys/bluetooth/mesh/delayable_msg.c (upstream repository)
• FIRST EPSS — not yet scored for this CVE (no value available at time of writing)
• CISA KEV — not listed for this CVE

No public proof-of-concept, exploit code, or in-the-wild exploitation evidence was identified for CVE-2026-19937 at the time of writing.