CVE-2026-19738

The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LL_CIS_REQ, and on the central for the whole duration of a locally initiated CIS Create. In subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c, the "invalid PDU received" paths of llcp_rp_cc_rx() and llcp_lp_cc_rx() terminated the connection and completed the procedure without releasing that retained node, breaking the invariant checked in llcp_lr_check_done() and llcp_rr_check_done() and orphaning the node's memory. A peer device within radio range can reach this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link. Against a peripheral, the attacker sends a valid LL_CIS_REQ and then, before the Host replies, any unrelated LL Control PDU (for example LL_VERSION_IND), which ull_cp_rx() routes into the active remote procedure. Against a central performing a CIS Create, a malicious peripheral answers with LL_UNKNOWN_RSP for CIS_REQ, which is dispatched into the active local procedure. No pairing, encryption or user interaction is required; the code is compiled in when CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is enabled. In default builds (CONFIG_BT_CTLR_ASSERT_DEBUG is default y) the retained-node assertion fires immediately, producing a controller fatal error and, typically, a system reset from one injected PDU. With the development assertions disabled, each attempt permanently loses one node from the controller's small LL notification pool (LL_PDU_RX_CNT, 2 * CONFIG_BT_CTLR_LLCP_CONN) together with its memq_link_t; repeating the connect-attack-reconnect cycle exhausts the pool, after which notification allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults. The impact is limited to availability — the leaked node is orphaned, never reused or double-freed — and recovery requires a reboot.

• CWE-401

• https://github.com/zephyrproject-rtos/zephyr/commit/fde17f2c3de0118f3796c2a83958ee4ce4b5efd6
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6mcj-5jw8-ff36

Published

Oct 11, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19730The 'podman quadlet install --replace' command opens the exi…4.2
• CVE-2026-19733Server-Side request forgery (SSRF) vulnerability in Yordam I…5.3
• CVE-2026-19734Missing Authorization and Authorization Bypass Through User-…8.6
• CVE-2026-19735The RFC 6528 initial-sequence-number implementation in subsy…4.8
• CVE-2026-19736The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_…7.8
• CVE-2026-19737i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validat…5.5
• CVE-2026-19739The Bluetooth Link Layer control procedure code in subsys/bl…6.5
• CVE-2026-1974A vulnerability was identified in Free5GC up to 4.1.0. This …7.5
• CVE-2026-19740The Link Layer Control Procedure (LLCP) implementation of th…6.5
• CVE-2026-19741Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JO…7.5
• CVE-2026-19742The IPv6 stack derived the long-lived secret key used to com…3.7
• CVE-2026-19743Improper path validation in the local IPC service of TeamVie…7.8