CVE-2026-19740 in Zephyr
Summary
by MITRE • 10/11/2026
The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the update instant is reached (llcp_rx_node_retain() in subsys/bluetooth/controller/ll_sw/ull_llcp.c, and the node is deliberately not recycled while marked NODE_RX_TYPE_RETAIN). The invalid-PDU arms of llcp_lp_pu_rx() and llcp_rp_pu_rx() in subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c completed the procedure via llcp_lr_complete() / llcp_rr_complete() without first releasing that retained node, so the procedure context — the only remaining reference to the node — was freed while the node was still held out of the receive pool.
A peer device on an established LE connection can drive this deterministically and without pairing or encryption. Against a peripheral it sends LL_PHY_REQ, receives LL_PHY_RSP, sends a valid LL_PHY_UPDATE_IND with an instant a few connection events in the future (so the node becomes retained), and then, before the instant is reached, sends any other LL Control PDU such as LL_LENGTH_REQ; ull_cp_rx() routes it to the active remote PHY Update procedure, which takes the invalid-PDU path. The mirror case applies to a locally initiated PHY Update followed by an LL_REJECT_IND.
In the default configuration (CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG both default y) the violated invariant in llcp_lr_check_done() / llcp_rr_check_done() triggers a controller assertion, ending in k_oops() (or k_panic()) — a single crafted PDU sequence from radio range faults the device. With those assertions compiled out, each attempt silently leaks one receive PDU node and its memq link; because the controller receive pool is small (PDU_RX_CNT, driven by CONFIG_BT_CTLR_RX_BUFFERS, which defaults to 1) and each attempt costs the attacker only a reconnect, a few repetitions exhaust the pool and leave Bluetooth inoperable until reboot. On releases v3.4.0 through v3.7.x the assertion is never reached, whatever the configuration, so every attempt leaks silently.
The impact is limited to availability: the orphaned node leaves no dangling pointer that is later dereferenced and is never delivered to the host, so there is no memory corruption or information disclosure. The same pull request applies the identical release to the Connection Update and CIS-create procedures, whose invalid-PDU arms had the same omission.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability resides within the Link Layer Control Procedure implementation of the Zephyr software Bluetooth Low Energy controller, specifically affecting the handling of PHY update operations. The core technical flaw involves a memory management error where receive nodes are retained for future host notifications but fail to be released upon procedure completion via invalid paths. When an LL_PHY_UPDATE_IND is accepted, the system retains the corresponding receive node in anticipation of notifying the host at a specified instant. However, if the procedure terminates due to an invalid Protocol Data Unit through functions such as llcp_lp_pu_rx or llcp_rp_pu_rx, the code invokes completion routines like llcp_lr_complete without first freeing this retained node. Consequently, the procedure context is freed while it still holds the only reference to the receive node, leaving that node orphaned and removed from the available receive pool. This defect represents a classic resource leak stemming from improper state management during error handling paths in network protocol stacks.
From an operational perspective, this vulnerability allows for deterministic denial of service attacks against devices running affected versions of Zephyr without requiring authentication or encryption. An attacker within radio range can exploit this by initiating a PHY update sequence and then sending conflicting control PDUs before the scheduled instant occurs. In configurations where assertions are enabled, such as when CONFIG_BT_ASSERT is active, the violation triggers an immediate controller assertion leading to a kernel panic or oops, effectively crashing the device with minimal effort. Even in production builds where these safety checks are disabled, each exploitation attempt silently leaks one receive PDU node and its associated memory queue link. Since the default configuration often sets the maximum number of RX buffers to just one via CONFIG_BT_CTLR_RX_BUFFERS, repeated attempts quickly exhaust this limited pool. Once exhausted, the Bluetooth controller becomes inoperable until a full system reboot is performed, rendering any device dependent on that connection unusable for denial-of-service purposes.
The impact scope is strictly confined to availability rather than confidentiality or integrity. The orphaned node does not result in dangling pointer dereferences nor is it delivered to the host application layer, thereby preventing memory corruption vulnerabilities and information disclosure attacks. However, the cumulative effect of resource exhaustion creates a persistent service disruption that requires administrative intervention to resolve. This specific flaw was identified alongside similar omissions in Connection Update and CIS-create procedures, indicating a systemic pattern in how invalid protocol states were handled across multiple link-layer mechanisms within the Zephyr codebase during versions 3.4.0 through 3.7.x.
To mitigate this vulnerability, developers must apply the patch that ensures proper release of retained receive nodes upon procedure completion via all valid and invalid paths. This includes updating llcp_lr_complete and llcp_rr_complete to explicitly free any retained resources before context teardown. For system administrators managing deployed devices, it is critical to ensure that firmware updates incorporating these fixes are applied promptly. In environments where immediate patching is not feasible, implementing network-level filtering or restricting Bluetooth connectivity to trusted pairs can reduce the attack surface by preventing unauthorized peers from initiating PHY update procedures. Monitoring for unusual patterns of connection resets and resource exhaustion may also aid in detecting active exploitation attempts against unpatched systems.
This vulnerability aligns with CWE-401, which describes a missing release of memory after successful allocation, leading to resource consumption issues that can degrade system performance or cause crashes. In terms of offensive security frameworks, the attack vector corresponds to ATT&CK technique T1499, specifically Endpoint Denial of Service via application exhaustion. The lack of authentication requirements for triggering this state makes it particularly dangerous in open wireless environments where adversaries can easily interact with vulnerable devices. Addressing these memory management oversights is essential for maintaining the reliability and availability of Bluetooth Low Energy services in embedded systems relying on Zephyr RTOS.