CVE-2026-19739

Executive Summary

CVE-2026-19739 is a use-after-free vulnerability in the Zephyr RTOS Bluetooth Link Layer (LL) controller implementation, specifically in the Connection Update / Connection Parameter procedure handling. An unauthenticated attacker within Bluetooth radio range can trigger this flaw by sending a valid LL_CONNECTION_UPDATE_IND followed by a second, arbitrary LL Control PDU before the connection update instant occurs. Successful exploitation leads to a denial-of-service (crash) condition on the affected peripheral or central device, with potential for further memory corruption. The vulnerability requires no pairing, bonding, or encryption, making it exploitable by any peer in proximity.

Technical Analysis

The vulnerability resides in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c, which implements the Bluetooth Link Layer Connection Update procedure. During normal operation, when a LL_CONNECTION_UPDATE_IND is received, the controller retains the RX node (llcp_rx_node_retain()) to carry the host notification, marking it as NODE_RX_TYPE_RETAIN. This retained node is expected to be released once the procedure completes.

The flaw occurs in the default arm of llcp_rp_cu_rx() and llcp_lp_cu_rx() — the "invalid PDU, terminate the connection" path. When an unexpected LL Control PDU (e.g., LL_LENGTH_REQ) arrives while the Connection Update procedure is in RP_CU_STATE_WAIT_INSTANT, it routes into the active procedure and takes this invalid-PDU path. The path completes the procedure without releasing the retained RX node. Subsequently, llcp_rr_check_done() dequeues and frees the procedure context, but ctx->node_ref.rx still points to the retained node, dropping the last reference. This results in a use-after-free (CWE-401: Missing Release of Memory after Effective Lifetime).

The attack surface is the Bluetooth Link Layer control procedure, accessible to any peer in radio range without authentication. The peripheral role is reachable by sending a LL_CONNECTION_UPDATE_IND with a future instant, then sending any other LL Control PDU before the instant. The central role is reachable symmetrically after accepting a LL_CONNECTION_PARAM_REQ, and the local-procedure variant is reachable with LL_REJECT_IND.

With CONFIG_BT_CTLR_ASSERT_DEBUG enabled (default), the invariant asserted in llcp_rr_check_done() is violated, leading to a crash (denial of service). Without the assertion, the use-after-free could potentially be exploited for memory corruption, though no public exploit exists.

Exploitation Scenarios

1. Reconnaissance/Target Identification: An attacker within Bluetooth radio range identifies a target device running Zephyr RTOS with the Bluetooth LL controller enabled. No pairing or authentication is required.
2. Triggering the Flaw: The attacker sends a well-formed LL_CONNECTION_UPDATE_IND with an instant set a few connection events in the future. This causes the target to retain the RX node and enter RP_CU_STATE_WAIT_INSTANT. Before the instant is reached, the attacker sends any other LL Control PDU, such as LL_LENGTH_REQ. The target routes this PDU into the active Connection Update procedure, triggering the invalid-PDU path that fails to release the retained node.
3. Payload/Execution Method: The payload is a sequence of Bluetooth LL Control PDUs. No code injection is required; the mere sequence of PDUs triggers the use-after-free. The vulnerability class is a use-after-free, leading to a crash (denial of service) under default configurations, with potential for memory corruption.
4. Post-Exploitation Impact: The target device crashes or becomes unresponsive, disrupting Bluetooth communication. In a non-assert build, the use-after-free could be leveraged for further exploitation, such as arbitrary code execution or information disclosure, though no public PoC exists. No public PoC is available; the attack chain is inferred from the vulnerability class.

Impact Assessment

The CVSS score is 6.5 (Medium), with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack requires adjacency (AV:A), low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). The impact is solely on availability (A:H), with no confidentiality or integrity impact. This indicates a denial-of-service condition. Affected systems include any device running Zephyr RTOS with Bluetooth LL controller enabled, such as IoT sensors, wearables, and industrial controllers. The blast radius is limited to devices within Bluetooth range, but the lack of authentication makes it easy to exploit en masse.

Detection Guidance

Sigma Rule

title: Zephyr Bluetooth LL Connection Update Use-After-Free
id: 7a9b3c1d-2e4f-4a5b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects sequence of LL_CONNECTION_UPDATE_IND followed by an unexpected LL Control PDU (e.g., LL_LENGTH_REQ) within a short time window, indicative of CVE-2026-19739 exploitation.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
    product: bluetooth
    service: link_layer
detection:
    selection_update:
        pdu_type: 'LL_CONNECTION_UPDATE_IND'
    selection_other:
        pdu_type: 
            - 'LL_LENGTH_REQ'
            - 'LL_REJECT_IND'
            - 'LL_CONNECTION_PARAM_REQ'
    condition: selection_update followed by selection_other within 500ms
falsepositives:
    - Normal connection update procedures with subsequent legitimate control PDUs
level: high

YARA Rule

rule CVE_2026_19739_Zephyr_BT_LL_UAF
{
    meta:
        description = "Detects use-after-free in Zephyr Bluetooth LL Connection Update procedure"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19739"
        hash = "unknown"
    strings:
        $s1 = "llcp_rx_node_retain" ascii wide
        $s2 = "llcp_rp_cu_rx" ascii wide
        $s3 = "llcp_lp_cu_rx" ascii wide
        $s4 = "llcp_rr_check_done" ascii wide
        $s5 = "RP_CU_STATE_WAIT_INSTANT" ascii wide
    condition:
        any of them
}

Suricata IDS Rule

alert bluetooth any any -> any any (msg:"CVE-2026-19739 Zephyr Bluetooth LL Connection Update Use-After-Free Attempt"; flow:to_server,established; content:"|0x0A|"; content:"|0x12|"; within:10; content:"|0x0B|"; within:20; classtype:attempted-dos; sid:1000001; rev:1;)

Elastic Detection

sequence by host.id with maxspan=1s
  [ network where bluetooth.pdu_type == "LL_CONNECTION_UPDATE_IND" ]
  [ network where bluetooth.pdu_type in ("LL_LENGTH_REQ", "LL_REJECT_IND", "LL_CONNECTION_PARAM_REQ") ]

Splunk SPL Query

index=bluetooth sourcetype=bt_ll
| rex field=_raw "pdu_type=(?<pdu_type>\w+)"
| streamstats window=2 global=f current=f last(pdu_type) as prev_pdu by src_mac, dest_mac
| where prev_pdu=="LL_CONNECTION_UPDATE_IND" AND pdu_type!="LL_CONNECTION_UPDATE_IND"
| table _time, src_mac, dest_mac, prev_pdu, pdu_type

Wazuh OSSEC Rule

<group name="bluetooth,">
  <rule id="100001" level="12">
    <decoded_as>bluetooth_pdu</decoded_as>
    <field name="pdu_type">LL_CONNECTION_UPDATE_IND</field>
    <description>CVE-2026-19739: Suspicious LL_CONNECTION_UPDATE_IND detected</description>
  </rule>
  <rule id="100002" level="12">
    <decoded_as>bluetooth_pdu</decoded_as>
    <field name="pdu_type">LL_LENGTH_REQ|LL_REJECT_IND|LL_CONNECTION_PARAM_REQ</field>
    <description>CVE-2026-19739: Potential follow-up PDU for use-after-free</description>
  </rule>
</group>

Mitigation & Patch Guidance

1. Immediate Mitigations: Disable Bluetooth on affected devices if not required. If Bluetooth is necessary, limit radio range to trusted environments. Monitor for abnormal LL Control PDU sequences (e.g., LL_CONNECTION_UPDATE_IND followed by LL_LENGTH_REQ). Use Bluetooth sniffer tools to detect such sequences.
2. Patch/Upgrade Steps: Currently UNPATCHED (Patch Confidence: 0/4). No vendor fix is available. Monitor Zephyr RTOS security advisories for future patches. Apply updates as soon as they are released.
3. Long-Term Hardening: Implement secure coding practices to ensure memory references are properly released on all code paths, especially error paths. Enable CONFIG_BT_CTLR_ASSERT_DEBUG to catch invariant violations, but note that it leads to a crash (better than silent memory corruption). Consider using memory-safe languages or static analysis tools to detect use-after-free vulnerabilities.

References

• NVD — CVE-2026-19739
• Zephyr Project Security Advisories
• Bluetooth SIG Security
• CWE-401: Missing Release of Memory after Effective Lifetime