CVE-2026-19937 | CVSS: 5.7 | 严重级别: MEDIUM
The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT message contexts (default 4) threaded onto a free_ctx or busy_ctx list. release_delayable_msg_ctx() returned a context to free_ctx only when sys_slist_find_and_remove() found it on busy_ctx. The chunk-exhaustion error path in bt_mesh_delayable_msg_manage() releases a context that was already popped off free_ctx but not yet inserted on busy_ctx, so the context was appended to neither list and was permanently lost from the pool. B
参考链接:
• https://github.com/zephyrproject-rtos/zephyr/commit/097001f187ba2764e9ef1cc7113b
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5rrx-xww6-
📌 数据来源: NVD 官方