# CVE-2026-19937: Zephyr Bluetooth Mesh Access layer delayable message context leak

Source: https://junglewise.ai/threats/cve-2026-19937-the-bluetooth-mesh-access-layer-delayable-message-machinery-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19937 · Severity: medium · CVSS 5.7 · Published 2026-10-13

The Zephyr RTOS Bluetooth Mesh Access layer has a flaw where message contexts used for delayed transmission are permanently lost under error conditions, draining the pool. A provisioned mesh peer can trigger this leak by flooding a victim node with segmented requests while withholding acknowledgments, eventually exhausting all contexts and causing the node to drop all responses—a denial of service that persists until reboot.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19937 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19937 being exploited in the wild.

**How severe is CVE-2026-19937?** Medium severity, with a CVSS score of 5.7, published 13 October 2026.

**Which products and versions are affected?** Zephyr RTOS all versions with CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG enabled (default).

**Is there a fix for CVE-2026-19937?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19937 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-19937?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource leak in subsys/bluetooth/mesh/delayable_msg.c where release_delayable_msg_ctx() fails to return a context to the free list if an error occurs when bt_mesh_access_send() returns -EBUSY or -ENOBUFS during bt_mesh_delayable_msg_manage(). The context is popped from free_ctx but left untracked, permanently lost. An attacker with network and AppKey access can exploit this by sending segmented requests with withheld Segment Acknowledgments, holding transmit contexts and starving the chunk pool; each subsequent request in that window causes a leak, eventually reaching -ENOMEM and silently dropping all model replies.

## Affected products

- Zephyr RTOS all versions with CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG enabled (default)

## Timeline

- 2026-10-13: disclosed

## Related threats

- [Zephyr Bluetooth HCI USB buffer overflow in controller-to-host path](https://junglewise.ai/threats/cve-2026-79982-the-bluetooth-hci-usb-transport-class-of-the-new-usb-device-stack)
- [Zephyr RTOS PECI driver privilege escalation in peci_transfer()](https://junglewise.ai/threats/cve-2026-19676-the-user-mode-verifier-for-the-peci-transfer-system-call-z-vrfy)
- [Zephyr Bluetooth host ATT buffer use-after-free in signed write path](https://junglewise.ai/threats/cve-2026-19938-the-bluetooth-host-s-att-transmit-path-releases-a-buffer-it-does)
- [Zephyr TCP ISN derivation with all-zero key on entropy failure](https://junglewise.ai/threats/cve-2026-19735-the-rfc-6528-initial-sequence-number-implementation-in-subsys-net)
- [Zephyr RTOS IEEE 802.15.4 integer underflow in frame decryption](https://junglewise.ai/threats/cve-2026-19186-ieee802154-decipher-data-frame-in-subsys-net-l2-ieee802154)