Is CVE-2026-19936 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19936 being exploited in the wild.

How severe is CVE-2026-19936?

Medium severity, with a CVSS score of 4.8, published 13 October 2026.

Which products and versions are affected?

Zephyr Project Zephyr RTOS versions with CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG enabled (defaults to y).

How is CVE-2026-19936 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-19936?

Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19936: Zephyr Bluetooth Mesh delayable message queue race condition

CVE-2026-19936 · Severity: medium · CVSS 4.8 · Published 2026-10-13

Zephyr's Bluetooth Mesh implementation has a race condition in how it manages delayed message responses between two internal threads. An attacker with network access to the mesh (holding valid keys) can trigger the race condition by sending crafted messages, causing the system to crash or stop processing mesh communications. This impacts the availability of mesh network nodes but does not allow data theft or remote code execution.

Technologies: Zephyr Project Zephyr RTOS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19936 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19936 being exploited in the wild.
How severe is CVE-2026-19936?: Medium severity, with a CVSS score of 4.8, published 13 October 2026.
Which products and versions are affected?: Zephyr Project Zephyr RTOS versions with CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG enabled (defaults to y).
Is there a fix for CVE-2026-19936?: Yes: fixed in To be determined from official Zephyr release notes. Until then: Disable CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG or CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CTX_ENABLED in the Zephyr build configuration to bypass the vulnerable queue mechanism; restrict mesh network access to authorized devices only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19936 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-19936?: Check whether you run Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: To be determined from official Zephyr release notes

Disable CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG or CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_CTX_ENABLED in the Zephyr build configuration to bypass the vulnerable queue mechanism; restrict mesh network access to authorized devices only.

Technical details

The delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares intrusive lists and a delayed work item between the Bluetooth RX thread and system workqueue thread without synchronization, allowing both contexts to observe torn list state. An attacker with mesh NetKey and AppKey can exhaust the context and chunk pools by controlling message arrival rates and response sizes, triggering a NULL pointer dereference in pending_msg->fired_time at a fixed address on the workqueue thread. This causes workqueue thread abort or system reset, disabling mesh timing and availability.

Affected products

Zephyr Project Zephyr RTOS versions with CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG enabled (defaults to y)

Timeline

2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.