CVE-2026-19738

Executive Summary

CVE-2026-19738 is a memory leak (CWE-401) in the Zephyr Bluetooth Low Energy Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation. The flaw is triggered when a peer device sends a single extra LL Control PDU during an active CIS establishment procedure, causing a retained RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) to be orphaned and never released. Successful exploitation causes a controller assertion failure and fatal crash in default debug builds, resulting in a denial-of-service (DoS) condition affecting Bluetooth connectivity on affected devices. No authentication, encryption, or user interaction is required — any device within radio range can trigger the vulnerability.

Technical Analysis

The vulnerability resides in subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c, the LLCP control procedure implementation for CIS creation.

Root cause — retained RX node lifecycle: During CIS creation, the LLCP implementation retains an RX node (ctx->node_ref.rx, marked with NODE_RX_TYPE_RETAIN) so that it can later be reused as the host notification. This retained node exists:

• On the peripheral while awaiting the Host's reply to an LL_CIS_REQ, and
• On the central for the entire duration of a locally initiated CIS Create.

The "invalid PDU received" error paths in llcp_rp_cc_rx() (remote procedure / peripheral receive path) and llcp_lp_cc_rx() (local procedure / central receive path) terminate the connection and complete the procedure without releasing the retained node. This breaks the invariant checked in llcp_lr_check_done() and llcp_rr_check_done(), orphaning the node's memory — a classic memory leak (CWE-401).

Attack surface: The Bluetooth Link Layer ACL connection is the attack surface. The vulnerable code is compiled in when either CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is enabled — that is, any Zephyr BLE controller configured to support Connected Isochronous Streams (LE Audio, bidirectional audio, etc.).

Triggering conditions (from NVD description):

• Peripheral role: Attacker sends a valid LL_CIS_REQ and then, before the Host replies, any unrelated LL Control PDU (e.g., LL_VERSION_IND). ull_cp_rx() routes the unrelated PDU into the active remote procedure, hitting the invalid-PDU path.
• Central role: A malicious peripheral answers an LL_CIS_REQ with LL_UNKNOWN_RSP, which is dispatched into the active local procedure.

In both cases the retained node is not freed. The link is unauthenticated and unencrypted, and no pairing or encryption is required — only radio proximity (adjacent network).

Impact mechanism: In default builds (CONFIG_BT_CTLR_ASSERT_DEBUG defaults to y), the retained-node assertion fires immediately, producing a controller fatal error (crash). In non-assert builds, the orphaned node leaks, and repeated triggering can exhaust the limited controller RX node pool — a persistent DoS.

CVSS interpretation (6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H):

• AV:A (Adjacent): Requires radio range of the target device.
• AC:L (Low): Single extra LL Control PDU; no race complexity in the described paths.
• PR:N / UI:N: No authentication or user interaction.
• C:N / I:N / A:H: No confidentiality or integrity impact, but high availability impact (crash / memory exhaustion).

Exploitation Scenarios

No public PoC is available. The following chain is strictly derived from the NVD description; no fabricated endpoints or symbols are used.

1) Reconnaissance / target identification: The attacker identifies a target running a Zephyr BLE controller with ISO support enabled (CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO). This can be inferred from BLE advertising, service discovery indicating LE Audio/CIS support, or fingerprinting device firmware. Physical or radio proximity is required (adjacent network). Shodan-style Wi-Fi/BLE scanning can map potential deployments, but BLE requires local radio presence.

2) Triggering the flaw (peripheral target): The attacker establishes an unauthenticated, unencrypted ACL connection to the peripheral and sends a valid LL_CIS_REQ. Before the Host application replies, the attacker transmits an unrelated LL Control PDU — for example LL_VERSION_IND. The controller's ull_cp_rx() routes this PDU into the active remote CIS procedure, landing in the "invalid PDU received" path of llcp_rp_cc_rx(). That path terminates the connection and completes the procedure without releasing the retained ctx->node_ref.rx node.

3) Triggering the flaw (central target): If the victim is a central initiating a CIS Create, the attacker (acting as peripheral) answers the LL_CIS_REQ with LL_UNKNOWN_RSP. This response is dispatched into the active local procedure, hitting the invalid-PDU path of llcp_lp_cc_rx() and again orphaning the retained node.

4) Post-exploitation impact: In default debug builds the assertion in llcp_lr_check_done() / llcp_rr_check_done() fails immediately, crashing the controller (fatal error). In production builds without assertions, the node leaks. Because the procedure and connection terminate, the attacker can reconnect and repeat the trigger, progressively exhausting the controller's RX node memory pool. The result is a sustained denial of service: lost BLE connectivity, failed LE Audio/ISO sessions, and potentially a device reboot or watchdog reset. No code execution, data theft, or lateral movement is enabled — the impact is availability-only.

Impact Assessment

Business impact: Devices relying on Zephyr BLE ISO (LE Audio earbuds/hearing aids, wearables, medical audio devices, industrial sensors supporting CIS) can be rendered non-functional within radio range. A crash resets a controller, dropping all active BLE connections — critical for devices providing real-time audio or safety-relevant telemetry.

Affected systems: Any Zephyr-based BLE controller with peripheral ISO or central ISO support compiled in. This includes embedded products from multiple vendors using Zephyr as the RTOS/BLE stack.

Blast radius: Localized to radio range (adjacent network); one attacker device can target many nearby victims sequentially. No persistence or privilege escalation, but repeated triggering causes recurring outages.

CVSS subscores: Confidentiality None, Integrity None, Availability High. Base 6.5 (Medium). EPSS not yet scored by FIRST.org. Not listed in CISA KEV. No public exploit or Nuclei template available.

Detection Guidance

Because this is a BLE Link Layer flaw, network-layer detection (Suricata/Splunk/Elastic) is limited to gateway or host-log telemetry where BLE HCI traffic can be captured or controller logs are forwarded. The rules below are best-effort detection aids keyed on controller error strings and HCI event patterns; tune to your environment.

Sigma Rule

title: Zephyr BLE LLCP CIS Retained Node Assertion / Fatal Error
id: 8f3c1a2e-1973-8cve-2026-19738
status: experimental
description: Detects controller fatal error or retained-node assertion from the Zephyr BLE LLCP CIS creation procedure (CVE-2026-19738)
logsource:
  product: zephyr
  service: bluetooth
detection:
  keywords:
    - 'node_ref.rx'
    - 'NODE_RX_TYPE_RETAIN'
    - 'llcp_rp_cc_rx'
    - 'llcp_lp_cc_rx'
    - 'llcp_lr_check_done'
    - 'llcp_rr_check_done'
    - 'FATAL ERROR'
  condition: 1 of keywords
fields:
  - host
  - message
falsepositives:
  - Debug builds during development with verbose LLCP tracing
level: high

YARA Rule

rule CVE_2026_19738_Zephyr_LLCP_CIS_Leak
{
    meta:
        description = "Detects strings indicative of the vulnerable Zephyr BLE LLCP CIS code path (CVE-2026-19738)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-19738"
    strings:
        $src1 = "ull_llcp_cc.c" ascii
        $src2 = "node_ref.rx" ascii
        $src3 = "NODE_RX_TYPE_RETAIN" ascii
        $fn1  = "llcp_rp_cc_rx" ascii
        $fn2  = "llcp_lp_cc_rx" ascii
        $fn3  = "llcp_lr_check_done" ascii
        $fn4  = "llcp_rr_check_done" ascii
    condition:
        uint32(0) == 0x464C457F and 2 of them
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-19738 Zephyr BLE LLCP CIS Invalid PDU - Potential Retained Node Leak/DoS"; \
 content:"|06|"; depth:1; \
 reference:cve,2026-19738; \
 classtype:attempted-dos; \
 sid:202619738; rev:1;)

Note: Bluetooth Link Layer is not IP; this rule targets BLE-over-IP tunneling (HCI/IP) deployments or gateway bridges. Replace the content match with your BLE-over-IP encapsulation signature.

Elastic Detection

sequence by host.id with maxspan=5s
  [any where process.name : "*ble*" or process.name : "*bluetooth*"]
  [any where message : ("*llcp_rp_cc_rx*" or "*llcp_lp_cc_rx*" or "*node_ref.rx*" or "*FATAL ERROR*")]

Splunk SPL Query

index=embedded (sourcetype=zephyr:* OR sourcetype=bluetooth:*)
("llcp_rp_cc_rx" OR "llcp_lp_cc_rx" OR "node_ref.rx" OR "NODE_RX_TYPE_RETAIN" OR "llcp_lr_check_done" OR "llcp_rr_check_done" OR "FATAL ERROR")
| stats count min(_time) as first_seen max(_time) as last_seen by host
| where count > 0
| table host first_seen last_seen count

Wazuh OSSEC Rule

<group name="zephyr,bluetooth,cve-2026-19738,">
  <rule id="202619738" level="12">
    <decoded_as>syslog</decoded_as>
    <match>llcp_rp_cc_rx|llcp_lp_cc_rx|NODE_RX_TYPE_RETAIN|node_ref\.rx|llcp_lr_check_done|llcp_rr_check_done|FATAL ERROR</match>
    <description>CVE-2026-19738: Zephyr BLE LLCP CIS retained node assertion / controller fatal error detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>availability_impact,cve_2026_19738,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations:

• Disable Bluetooth ISO support if not operationally required: build with CONFIG_BT_CTLR_PERIPHERAL_ISO=n and CONFIG_BT_CTLR_CENTRAL_ISO=n to remove the vulnerable code path.
• In debug builds, act on controller assertions as security events (see detection rules) and enable watchdog-based recovery to minimize outage duration.
• Restrict the physical/radio attack surface: limit who can be within BLE radio range; where feasible, require encryption to reduce the pool of unauthenticated attackers (note: the flaw itself does not require pairing, so this is only a partial control).
• Monitor for repeated BLE disconnects/crashes that suggest active DoS attempts.

2) Patch / upgrade steps:

• No vendor patch is currently available. Track the Zephyr upstream repository (subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c) for a fix that releases ctx->node_ref.rx on the invalid-PDU terminate paths of llcp_rp_cc_rx() and llcp_lp_cc_rx().
• Once a fix is released, update the Zephyr tree and rebuild the firmware; validate the retained-node invariant with llcp_lr_check_done() and llcp_rr_check_done() under CIS stress testing.
• If maintaining a downstream fork, apply a local patch to free/unref the retained node before terminating the procedure on the invalid-PDU paths.

3) Long-term hardening:

• Adopt fuzzing and state-machine invariant testing for BLE LLCP procedure handlers, including invalid PDU injection.
• Enable memory leak detection (heap tracing) in CI for controller code paths.
• Prefer builds with assertion checks retained in staging; ensure production builds still reclaim resource nodes deterministically.
• Maintain a firmware SBOM to rapidly identify devices exposing ISO-enabled Zephyr controllers.

References

• NVD — CVE-2026-19738: https://nvd.nist.gov/vuln/detail/CVE-2026-19738
• CWE-401: Missing Release of Memory after Effective Lifetime — https://cwe.mitre.org/data/definitions/401.html
• Zephyr Project controller source — subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c (upstream repository; monitor for patch)
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-19738 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or known threat actor campaign is currently associated with CVE-2026-19738. The attack chain described is inferred from the vulnerability class (BLE Link Layer protocol handling) and the NVD-provided mechanics.