CVE-2026-19740: Zephyr Bluetooth LE Controller DOS Vulnerability

CVE-2026-19740 Overview

CVE-2026-19740 is a memory leak vulnerability [CWE-401] in the Zephyr real-time operating system Bluetooth Low Energy (LE) Controller. The flaw exists in the Link Layer Control Procedure (LLCP) implementation, specifically within the PHY Update procedure in subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c. When an invalid Link Layer Control PDU is received during an active PHY Update, the procedure completes without releasing a retained receive node, leaking it from the controller's small receive pool.

A peer device within Bluetooth radio range can trigger the condition on an established LE connection without pairing or encryption.

Critical Impact
A single crafted PDU sequence can crash the controller via assertion in default builds, or exhaust the receive pool across a few reconnects and render Bluetooth inoperable until reboot.

Affected Products

Zephyr RTOS Bluetooth LE Controller (releases v3.4.0 through v3.7.x leak silently regardless of configuration)
Zephyr builds with CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG enabled (default) — crash on first attempt
Zephyr builds with controller assertions compiled out — resource exhaustion over repeated attempts

Discovery Timeline

2026-10-11 - CVE-2026-19740 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-19740

Vulnerability Analysis

The Zephyr LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so the same node can later deliver the host notification when the update instant is reached. The retention is implemented by llcp_rx_node_retain() in subsys/bluetooth/controller/ll_sw/ull_llcp.c, and the node is deliberately not recycled while marked NODE_RX_TYPE_RETAIN.

The invalid-PDU arms of llcp_lp_pu_rx() and llcp_rp_pu_rx() completed the procedure through llcp_lr_complete() and llcp_rr_complete() without first releasing that retained node. The procedure context was the only remaining reference to the node, so freeing the context left the node held out of the receive pool with no owner.

Impact is limited to availability. The orphaned node is never dereferenced after being freed and is never delivered to the host, so there is no memory corruption or information disclosure.

Root Cause

The root cause is a missing cleanup call on the error path of the PHY Update LLCP state machine. On the valid-PDU path, the retained node is consumed and released as part of host notification. On the invalid-PDU path, the procedure terminates immediately without a corresponding llcp_rx_node_release(), violating the invariant checked by llcp_lr_check_done() and llcp_rr_check_done().

Attack Vector

A peer on an established LE connection drives the condition deterministically. Against a peripheral, the attacker sends LL_PHY_REQ, receives LL_PHY_RSP, then sends a valid LL_PHY_UPDATE_IND with an instant a few connection events in the future so the node becomes retained. Before the instant is reached, the attacker sends any other LL Control PDU such as LL_LENGTH_REQ.

ull_cp_rx() routes the follow-up PDU to the active remote PHY Update procedure, which takes the invalid-PDU path. The mirror case triggers on a locally initiated PHY Update followed by an LL_REJECT_IND. In default builds, this triggers k_oops() or k_panic(). With assertions disabled, the controller receive pool defined by PDU_RX_CNT (CONFIG_BT_CTLR_RX_BUFFERS defaults to 1) is drained after a handful of reconnect-and-repeat attempts.

 		/* Invalid behaviour */
 		/* Invalid PDU received so terminate connection */
 		conn->llcp_terminate.reason_final = BT_HCI_ERR_LMP_PDU_NOT_ALLOWED;
+
+		/* Release any retained RX node before completing the procedure,
+		 * the node would otherwise be leaked
+		 */
+		llcp_rx_node_release(ctx);
+
 		llcp_lr_complete(conn);
 		ctx->state = LP_PU_STATE_IDLE;
 		break;

Source: Zephyr commit 06bf10e3de16b57b864f969330188b59f7d69a63. The patch adds the missing llcp_rx_node_release(ctx) call before llcp_lr_complete(conn) and applies the identical fix to the Connection Update and CIS-create procedures.

Detection Methods for CVE-2026-19740

Indicators of Compromise

Unexpected controller assertions ending in k_oops() or k_panic() referencing llcp_lr_check_done() or llcp_rr_check_done() on devices running Zephyr Bluetooth LE Controller.
Bluetooth stack becoming unresponsive after a series of short-lived LE connections from the same peer, recoverable only by reboot.
Log entries showing BT_HCI_ERR_LMP_PDU_NOT_ALLOWED connection terminations correlated with prior LL_PHY_UPDATE_IND exchanges.

Detection Strategies

Audit firmware builds for Zephyr Bluetooth Controller versions in the affected range and confirm whether the commit 06bf10e3de16b57b864f969330188b59f7d69a63 is applied.
Instrument controller builds to count allocations and releases of receive PDU nodes and alert on monotonic growth of in-use nodes without corresponding releases.
Monitor LE link-layer traces for the PHY Update, then non-PHY LL Control PDU sequence before the update instant, which matches the exploit pattern.

Monitoring Recommendations

Collect device telemetry on Bluetooth subsystem restarts, kernel panics, and assertion failures from fielded Zephyr devices.
Track peripheral availability metrics in environments where IoT devices must remain reachable, and investigate correlated Bluetooth outages across devices in physical proximity.
Where possible, log the conn_handle and peer address associated with any BT_HCI_ERR_LMP_PDU_NOT_ALLOWED termination for forensic review.

How to Mitigate CVE-2026-19740

Immediate Actions Required

Identify all deployed devices running Zephyr Bluetooth LE Controller, particularly those built from v3.4.0 through v3.7.x where the leak occurs silently.
Apply the upstream fix from commit 06bf10e3de16b57b864f969330188b59f7d69a63 or upgrade to a Zephyr release containing the patch.
Rebuild and redeploy firmware for affected devices, prioritizing peripherals exposed in uncontrolled RF environments.

Patch Information

The fix is published in the Zephyr GitHub Security Advisory GHSA-rgw4-3qr8-pp36 and implemented in commit 06bf10e3de16b57b864f969330188b59f7d69a63. The same pull request applies the identical llcp_rx_node_release() call to the invalid-PDU arms of the Connection Update and CIS-create procedures.

Workarounds

Where firmware updates cannot be deployed immediately, restrict Bluetooth exposure by disabling advertising or connectability on devices that do not require active LE connections.
Operate affected devices only within RF-controlled or physically restricted areas to limit adjacent-network attack reach.
Implement a watchdog or supervisory process that reboots the device when the Bluetooth subsystem stops accepting connections, limiting the duration of denial-of-service conditions.

bash

# Apply the upstream fix to a Zephyr source tree
cd zephyr
git fetch origin
git cherry-pick 06bf10e3de16b57b864f969330188b59f7d69a63
west build -b <board> -p always <app>