CVE-2026-19739: Bluetooth Link Layer DOS Vulnerability

CVE-2026-19739 Overview

CVE-2026-19739 is a memory leak vulnerability [CWE-401] in the Zephyr RTOS Bluetooth Low Energy controller. The flaw resides in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c, which handles Link Layer Connection Update and Connection Parameter procedures. An adjacent attacker within Bluetooth radio range can trigger the condition without pairing, bonding, or encryption. The controller retains an RX node while waiting for a procedure instant but fails to release it when an invalid Protocol Data Unit (PDU) terminates the procedure. Repeated exploitation exhausts the fixed-size RX pool, forcing the receive path to operate on a NULL node and causing an unauthenticated denial of service until reboot.

Critical Impact
An adjacent, unauthenticated attacker can crash the Bluetooth controller or exhaust its RX buffer pool, producing a persistent denial of service on affected Zephyr devices.

Affected Products

Zephyr Project RTOS Bluetooth Controller (subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c)
Zephyr builds with CONFIG_BT_CTLR_ASSERT_DEBUG enabled (default) — immediate fatal assert
Zephyr builds with CONFIG_BT_CTLR_ASSERT_DEBUG disabled — gradual RX pool exhaustion based on CONFIG_BT_CTLR_RX_BUFFERS

Discovery Timeline

2026-10-11 - CVE-2026-19739 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-19739

Vulnerability Analysis

The Zephyr Bluetooth Link Layer control procedure code calls llcp_rx_node_retain() to mark a received RX node as NODE_RX_TYPE_RETAIN while a Connection Update or Connection Parameter procedure waits for its instant. This retention suppresses the normal node recycling path in ull.c so the node can later carry the host notification. The default: arm of both llcp_rp_cu_rx() and llcp_lp_cu_rx() handles the invalid-PDU terminate-connection case. That path completes the procedure without releasing the retained node. llcp_rr_check_done() then dequeues and frees the procedure context while ctx->node_ref.rx still references the retained node, dropping the last reference.

Root Cause

The root cause is a missing call to llcp_rx_node_release(ctx) on the invalid-PDU termination branch. The retained RX node becomes unreachable once the procedure context is freed. With asserts enabled, llcp_rr_check_done() triggers a fatal invariant violation. With asserts disabled, each occurrence permanently removes one buffer from the small fixed RX pool.

Attack Vector

A peer device in radio range sends a well-formed LL_CONNECTION_UPDATE_IND with an instant a few connection events in the future. The procedure enters RP_CU_STATE_WAIT_INSTANT and retains the RX node. Before the instant is reached, the peer sends any other LL Control PDU such as LL_LENGTH_REQ. ull_cp_rx() routes that PDU into the active remote Connection Update procedure, which takes the invalid-PDU path and leaks the node. The central role is reachable symmetrically after accepting an LL_CONNECTION_PARAM_REQ, and the local-procedure variant is reachable via LL_REJECT_IND.

		/* Invalid behaviour */
		/* Invalid PDU received so terminate connection */
		conn->llcp_terminate.reason_final = BT_HCI_ERR_LMP_PDU_NOT_ALLOWED;
+
+		/* Release any retained RX node before completing the procedure,
+		 * the node would otherwise be leaked
+		 */
+		llcp_rx_node_release(ctx);
+
		lp_cu_complete(conn, ctx);
		break;
	}

Source: Zephyr commit 7b600129faaba8bb26dd5cb3e8f17ed1cb41ea7f. The patch adds the missing llcp_rx_node_release(ctx) call before completing the procedure on the invalid-PDU path.

Detection Methods for CVE-2026-19739

Indicators of Compromise

Unexpected Bluetooth controller fatal asserts referencing llcp_rr_check_done() in device logs or crash dumps.
Repeated short-lived Bluetooth connections from the same peer address followed by immediate disconnects with reason BT_HCI_ERR_LMP_PDU_NOT_ALLOWED (0x24).
Progressive loss of Bluetooth receive capability on a device that recovers only after reboot.

Detection Strategies

Monitor Zephyr device logs for Link Layer termination events coupled with Connection Update or Connection Parameter procedure activity.
Capture over-the-air Bluetooth traces and flag sessions where LL_CONNECTION_UPDATE_IND or LL_CONNECTION_PARAM_REQ is followed by an unrelated LL Control PDU before the connection instant.
Track RX buffer pool occupancy counters where exposed, alerting on monotonic decrease across connection cycles.

Monitoring Recommendations

Instrument fleet telemetry to report controller reboots and HCI disconnection reason codes.
Correlate Bluetooth scan logs with device availability metrics to identify adjacent-network attack patterns.
Review build configurations to confirm whether CONFIG_BT_CTLR_ASSERT_DEBUG is enabled; the failure signature differs significantly between the two configurations.

How to Mitigate CVE-2026-19739

Immediate Actions Required

Apply the upstream Zephyr patch from commit 7b600129faaba8bb26dd5cb3e8f17ed1cb41ea7f and rebuild affected firmware images.
Deploy updated firmware to all Zephyr-based devices exposing Bluetooth Low Energy connectivity.
Audit device fleets for exposure where Bluetooth is enabled by default in untrusted radio environments.

Patch Information

The fix is published in the Zephyr project and tracked under GitHub Security Advisory GHSA-84v8-vgp5-4vc9. The code change in Zephyr commit 7b600129 adds llcp_rx_node_release(ctx) to the invalid-PDU termination branch in llcp_rp_cu_rx() and llcp_lp_cu_rx(), ensuring retained RX nodes return to the pool before the procedure context is freed.

Workarounds

Where feasible, disable Bluetooth connectivity on devices that do not require it until patched firmware is deployed.
Restrict device operation to physically controlled environments to limit adjacent-network exposure.
Increase CONFIG_BT_CTLR_RX_BUFFERS to delay pool exhaustion as a temporary measure; this does not eliminate the underlying leak.

bash

# Example Zephyr Kconfig change to increase RX buffer pool (mitigation only)
CONFIG_BT_CTLR_RX_BUFFERS=4
# Note: Patch application remains required; buffer increases only delay exhaustion.