CVE-2026-19738: Bluetooth LLCP CIS Implementation DOS Flaw

CVE-2026-19738 Overview

CVE-2026-19738 is a memory leak vulnerability [CWE-401] in the Zephyr RTOS Bluetooth controller. The flaw affects the Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation. An adjacent attacker within Bluetooth radio range can trigger a controller fatal error with a single malformed Link Layer Control PDU. No pairing, encryption, or user interaction is required on the unauthenticated Asynchronous Connection-Less (ACL) link.

Critical Impact
A peer device within radio range can force a Bluetooth controller fatal error and system reset using one unexpected LL Control PDU during CIS creation, resulting in a denial-of-service condition against affected Zephyr-based devices.

Affected Products

Zephyr RTOS Bluetooth Controller (subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c)
Builds with CONFIG_BT_CTLR_PERIPHERAL_ISO enabled
Builds with CONFIG_BT_CTLR_CENTRAL_ISO enabled

Discovery Timeline

2026-10-11 - CVE-2026-19738 published to the National Vulnerability Database
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-19738

Vulnerability Analysis

The Zephyr Bluetooth controller retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) during CIS creation so it can be reused as the host notification. On a peripheral, the node is retained while awaiting the Host's reply to an LL_CIS_REQ. On a central, it is retained for the entire duration of a locally initiated CIS Create.

The "invalid PDU received" paths of llcp_rp_cc_rx() and llcp_lp_cc_rx() terminate the connection and complete the procedure without releasing the retained node. This breaks the invariant enforced by llcp_lr_check_done() and llcp_rr_check_done(), orphaning the node's memory.

In default builds where CONFIG_BT_CTLR_ASSERT_DEBUG is y, the retained-node assertion fires immediately. The result is a controller fatal error and a system reset from one injected PDU. With development assertions disabled, each attack leaks one node from the small LL notification pool sized at 2 * CONFIG_BT_CTLR_LLCP_CONN. Repeated connect-attack-reconnect cycles exhaust the pool, after which the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults.

Root Cause

The error-handling branches in llcp_rp_cc_rx() and llcp_lp_cc_rx() call llcp_rr_complete() or llcp_lr_complete() without first invoking llcp_rx_node_release(ctx). The retained RX node and its associated memq_link_t are never returned to the controller's free pool, violating the completion-time invariant.

Attack Vector

Against a peripheral, the attacker sends a valid LL_CIS_REQ and then, before the Host replies, injects any unrelated LL Control PDU such as LL_VERSION_IND. The function ull_cp_rx() routes the unexpected PDU into the active remote procedure, hitting the invalid-PDU branch. Against a central performing a CIS Create, a malicious peripheral answers with LL_UNKNOWN_RSP for CIS_REQ, dispatching the response into the active local procedure.

		/* Invalid behaviour */
		/* Invalid PDU received so terminate connection */
		conn->llcp_terminate.reason_final = BT_HCI_ERR_LMP_PDU_NOT_ALLOWED;
+
+		/* Release any retained RX node before completing the procedure,
+		 * the node would otherwise be leaked
+		 */
+		llcp_rx_node_release(ctx);
+
		llcp_rr_complete(conn);
		ctx->state = RP_CC_STATE_IDLE;
		break;

Source: Zephyr commit fde17f2c3de0118f3796c2a83958ee4ce4b5efd6. The patch adds a call to llcp_rx_node_release(ctx) on the invalid-PDU paths before the procedure completes.

Detection Methods for CVE-2026-19738

Indicators of Compromise

Unexpected Bluetooth controller resets or LL_ASSERT fatal errors on devices performing CIS Create procedures.
Device logs showing termination reason BT_HCI_ERR_LMP_PDU_NOT_ALLOWED (0x24) correlated with LE Isochronous Channel activity.
Repeated short-lived ACL connections from the same peer device followed by controller instability.

Detection Strategies

Capture over-the-air traffic with a Bluetooth Low Energy sniffer and inspect LL Control PDUs following LL_CIS_REQ for unexpected opcodes such as LL_VERSION_IND or LL_UNKNOWN_RSP referencing CIS_REQ.
Monitor Zephyr controller logs for assertion failures originating in llcp_lr_check_done(), llcp_rr_check_done(), or llcp_lp_cc_flush().
Alert on patterns of connect-disconnect cycles from unknown peripherals that correlate with increased notification allocation failures.

Monitoring Recommendations

Track controller memory pool utilization, specifically the LL_PDU_RX_CNT notification pool, for progressive exhaustion.
Instrument device telemetry to report unexpected reboots and HCI error codes to a central logging platform for correlation.

How to Mitigate CVE-2026-19738

Immediate Actions Required

Apply the upstream Zephyr fix from commit fde17f2c3de0118f3796c2a83958ee4ce4b5efd6 and rebuild affected firmware images.
Inventory deployed devices with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO enabled and prioritize those for firmware updates.
Limit Bluetooth operation in untrusted radio environments until patched firmware is deployed.

Patch Information

The fix is published in the Zephyr Security Advisory GHSA-6mcj-5jw8-ff36 and implemented in the upstream commit fde17f2c3de0118f3796c2a83958ee4ce4b5efd6. The patch releases the retained RX node in llcp_rp_cc_rx() and llcp_lp_cc_rx() before completing the procedure on invalid-PDU paths.

Workarounds

Disable CONFIG_BT_CTLR_PERIPHERAL_ISO and CONFIG_BT_CTLR_CENTRAL_ISO in Kconfig if LE Isochronous Channels are not required by the product.
Restrict which peer devices are allowed to initiate ACL connections by enforcing allowlists at the application layer where feasible.

bash

# Kconfig workaround: disable Isochronous Channel support if unused
CONFIG_BT_CTLR_PERIPHERAL_ISO=n
CONFIG_BT_CTLR_CENTRAL_ISO=n