CVE-2026-19936: race in zephyrproject zephyr

The Bluetooth Mesh Access-layer delayable message queue in Zephyr's subsys/bluetooth/mesh/delayable_msg.c shares intrusive lists and a delayable work item between two cooperative threads without synchronization. This leads to a race condition where one thread may observe a torn list state, causing a NULL pointer dereference and a write to a fixed low address on the system workqueue thread. The impact is a fault that aborts the system workqueue thread or resets the node, resulting in loss of availability. The vulnerability arises because the enqueuer and handler threads manipulate shared lists without proper locking, and unchecked list operations lead to duplicated transmissions and crossed chunk ownership. The fix introduces a k_spinlock to serialize list mutations, atomic detachment of queue heads, and removal of unchecked list gets, preventing the race and associated faults.

Exploitation of this race condition causes a NULL pointer dereference that faults the system workqueue thread or resets the affected node, resulting in loss of availability of the Bluetooth mesh node. There is no impact on confidentiality or integrity, and no memory corruption or code execution is possible. The denial of service affects mesh timing and workqueue-driven functionality on the node.

A fix is available that serializes all list mutations with a k_spinlock, avoids holding the lock across blocking calls, atomically detaches queue heads before sending messages, removes unchecked sys_slist_get() calls, and drops messages when the stack is suspended or reset. Users should apply the official patch or upgrade to a fixed version to remediate this issue.