CVE-2026-19936 | CVSS: 4.8 | 严重级别: MEDIUM
The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronization: bt_mesh_delayable_msg_manage() runs on the Bluetooth host RX thread, while delayable_msg_handler() runs on the system workqueue. Both block while the lists are in an intermediate state — the enqueuer in bt_rand(), both in bt_mesh_access_send() — which lets the other context observe torn state. delayable_msg_handler() used the result of sys_slist_get() on b
参考链接:
• https://github.com/zephyrproject-rtos/zephyr/commit/0a6da68955f454edc41e4b916e05
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4p55-7h77-
📌 数据来源: NVD 官方