CVE-2026-19937: dos in zephyrproject zephyr

The Bluetooth Mesh Access layer in Zephyr manages a static pool of message contexts for delayed messages. Due to a flaw in the error handling path of bt_mesh_delayable_msg_manage(), a context can be lost permanently from the pool when chunk exhaustion occurs and the oldest pending message cannot be flushed. This leak happens because the context is removed from the free list but not added to the busy list, making it unavailable for reuse. A provisioned mesh peer can trigger this condition by flooding the device with requests that elicit segmented responses while withholding segment acknowledgments, causing transmit contexts and chunk pools to be exhausted. Once the pool is drained, all subsequent sends fail with -ENOMEM, and the device silently drops replies, causing a denial of service until reboot. No memory corruption or information disclosure occurs. Earlier releases before the fix made the leak easier to provoke due to incorrect chunk count calculations.

An attacker with mesh network provisioning can cause a persistent denial of service by exhausting the delayable message context pool, leading the device to silently drop all replies from server models. The device continues to receive and process traffic but does not respond, disrupting normal mesh network operations. There is no impact on confidentiality or integrity, and no memory corruption occurs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limiting or filtering mesh network traffic from untrusted or suspicious provisioned peers may reduce exposure. A device reboot clears the leaked contexts and restores normal operation. Monitor vendor channels for official fixes or updates.