CVE-2026-19738 in Zephyr
Summary
by MITRE • 10/11/2026
The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LL_CIS_REQ, and on the central for the whole duration of a locally initiated CIS Create. In subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c, the "invalid PDU received" paths of llcp_rp_cc_rx() and llcp_lp_cc_rx() terminated the connection and completed the procedure without releasing that retained node, breaking the invariant checked in llcp_lr_check_done() and llcp_rr_check_done() and orphaning the node's memory.
A peer device within radio range can reach this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link. Against a peripheral, the attacker sends a valid LL_CIS_REQ and then, before the Host replies, any unrelated LL Control PDU (for example LL_VERSION_IND), which ull_cp_rx() routes into the active remote procedure. Against a central performing a CIS Create, a malicious peripheral answers with LL_UNKNOWN_RSP for CIS_REQ, which is dispatched into the active local procedure. No pairing, encryption or user interaction is required; the code is compiled in when CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is enabled.
In default builds (CONFIG_BT_CTLR_ASSERT_DEBUG is default y) the retained-node assertion fires immediately, producing a controller fatal error and, typically, a system reset from one injected PDU. With the development assertions disabled, each attempt permanently loses one node from the controller's small LL notification pool (LL_PDU_RX_CNT, 2 * CONFIG_BT_CTLR_LLCP_CONN) together with its memq_link_t; repeating the connect-attack-reconnect cycle exhausts the pool, after which notification allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults. The impact is limited to availability — the leaked node is orphaned, never reused or double-freed — and recovery requires a reboot.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability resides within the Bluetooth Link Layer Control Procedure implementation for Connected Isochronous Stream creation, specifically affecting both peripheral and central roles when ISO support configurations are enabled. The core technical flaw involves improper resource management during error handling paths in the LLCP subsystem. When establishing a CIS connection, the controller retains an RX node marked as NODE_RX_TYPE_RETAIN to facilitate host notifications while awaiting replies or completing locally initiated procedures. However, upon receiving invalid PDUs that trigger termination of the connection and completion of the procedure, the code fails to release this retained node. This omission breaks critical invariants checked by llcp_lr_check_done() and llcp_rr_check_done(), resulting in memory leaks where nodes are orphaned from the controller's notification pool without being properly deallocated or reused.
The attack vector is highly accessible as it requires only a single extra LL Control PDU sent over an unauthenticated, unencrypted ACL link to any device within radio range. For peripheral devices, an attacker sends a valid LL_CIS_REQ and subsequently injects an unrelated LL Control PDU such as LL_VERSION_IND before the host responds, causing the controller to route this unexpected data into the active remote procedure context. Conversely, for central devices initiating CIS creation, a malicious peripheral can respond with an LL_UNKNOWN_RSP to the initial request, which is then incorrectly dispatched into the active local procedure context. This exploitation does not require pairing, encryption, or any form of user interaction, making it particularly dangerous in open Bluetooth environments where default configurations often lack strict authentication requirements for initial link establishment phases.
The operational impact manifests primarily as a denial-of-service condition with severe availability implications depending on debug configuration settings. In standard development builds where CONFIG_BT_CTLR_ASSERT_DEBUG is enabled by default, the retained-node assertion triggers immediately upon exploitation, causing a controller fatal error that typically results in an immediate system reset from just one injected PDU. This provides attackers with a reliable method to disrupt Bluetooth connectivity and potentially crash embedded systems relying on stable controller operation. The vulnerability aligns with CWE-401 (Missing Release of Memory after Effective Lifetime) as the retained node is never freed, leading to resource exhaustion over time if assertions are disabled in production builds where debug checks might be stripped for performance reasons.
When assertion debugging is disabled, each successful exploitation permanently removes one node from the controller's limited LL notification pool along with its associated memory queue link structure. The total capacity of this pool is constrained by LL_PDU_RX_CNT and configured limits on concurrent connections. Repeated cycles of connection attempts followed by disconnection attacks will eventually exhaust all available nodes in the pool. Once exhausted, subsequent allocation requests for notifications fail consistently, causing RX flow control to stall entirely. This state triggers a non-disableable assertion error within llcp_lp_cc_flush(), resulting in another system fault or crash. The impact is strictly limited to availability since the leaked memory is orphaned rather than double-freed, preventing arbitrary code execution but ensuring that recovery requires a full reboot of the affected device.
Mitigation strategies must address both immediate patching and long-term architectural improvements. Immediate remediation involves updating the Bluetooth controller firmware or stack implementation to ensure that all termination paths in llcp_rp_cc_rx() and llcp_lp_cc_rx() properly release retained RX nodes before completing procedures. This includes verifying that cleanup routines are called regardless of whether the procedure ends successfully, via timeout, or due to invalid PDU reception. Additionally, implementing stricter validation checks for incoming PDUs during active CIS setup phases can prevent unrelated control messages from being routed into inappropriate procedural contexts. Organizations should also consider disabling ISO support features if not strictly required in their deployment environments to reduce the attack surface area associated with these specific code paths.
From a threat modeling perspective using MITRE ATT&CK, this vulnerability corresponds to techniques involving resource exhaustion and denial of service against networked devices. The lack of authentication requirements for initial link establishment highlights weaknesses in access control mechanisms typical of older Bluetooth profiles or misconfigured modern implementations. Security auditors should prioritize reviewing configurations that enable CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO to assess exposure levels. Furthermore, integrating runtime memory safety checks and fuzzing tools targeting the LLCP subsystem can help identify similar resource management flaws before they reach production environments. Ensuring robust error handling paths that consistently clean up allocated resources is essential for maintaining system stability in Bluetooth-enabled IoT devices and mobile platforms.