CVE-2026-19740

Executive Summary

CVE-2026-19740 is a memory-management flaw (CWE-401, missing release of memory after effective lifetime) in the Link Layer Control Procedure (LLCP) implementation of the Zephyr Bluetooth LE Controller. A peer device on an established LE connection can deterministically drive an invalid-PDU path in the PHY Update procedure (llcp_lp_pu_rx() / llcp_rp_pu_rx() in subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c) that completes the procedure without releasing a retained receive node, freeing the procedure context while the node remains held out of the receive pool. On default builds this violates an internal invariant handled through assert paths, producing denial of service; no pairing or encryption is required.

Technical Analysis

The vulnerability resides in the LLCP implementation of the Zephyr Bluetooth LE Controller. The controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so it can be reused for the host notification when the update instant is reached. Retention is performed by llcp_rx_node_retain() in subsys/bluetooth/controller/ll_sw/ull_llcp.c, and the node is deliberately not recycled while marked NODE_RX_TYPE_RETAIN.

The defect is in the invalid-PDU handling arms of llcp_lp_pu_rx() and llcp_rp_pu_rx() in subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c. These arms complete the procedure via llcp_lr_complete() / llcp_rr_complete() without first releasing the retained node. Because the procedure context is the only remaining reference to that node, completion frees the context while the node is still held out of the receive pool. The result is a dangling retained node with no owning context — a classic missing-release/lifetime violation (CWE-401).

The flawed invariant is checked in llcp_lr_check_done() / llcp_rr_... (description truncated). In the default configuration, both CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG default to y, so the violated invariant is caught by the assert path. The attack surface is the Link Layer control channel of an established LE connection, reachable by any peer device without pairing or encryption.

Attack mechanism: the peer drives a PHY Update to the point where the receive node becomes retained, then forces the procedure down the invalid-PDU arm before the update instant is reached, triggering completion without node release and consequent assertion/DoS.

Exploitation Scenarios

No public PoC is available; the attack chain below is derived strictly from the NVD description.

1. Reconnaissance / target identification: The attacker identifies a target running the Zephyr Bluetooth LE Controller with an established LE connection (e.g., a peripheral). No pairing or encryption is needed — proximity (AV:A) within BLE radio range is sufficient.

2. Triggering the flaw class: Against a peripheral, the attacker:

   • Sends LL_PHY_REQ and receives LL_PHY_RSP.
   • Sends a valid LL_PHY_UPDATE_IND with an instant a few connection events in the future, causing the receive node to become retained (NODE_RX_TYPE_RETAIN).
   • Before the instant is reached, sends any other LL Control PDU, such as LL_LENGTH_REQ. ull_cp_rx() routes this PDU to the active remote PHY Update procedure, which takes the invalid-PDU path (llcp_lp_pu_rx() / llcp_rp_pu_rx()).

3. Execution at the vulnerability-class level: On the invalid-PDU arm, the procedure completes via llcp_lr_complete() / llcp_rr_complete() without first releasing the retained node. The procedure context — the only remaining reference — is freed while the node remains held out of the receive pool, violating the missing-release invariant.

4. Post-exploitation impact: The mirrored case applies to a locally initiated PHY Update followed by an LL_REJECT_IND. In default configurations (both CONFIG_BT_ASSERT and CONFIG_BT_CTLR_ASSERT_DEBUG default y), the violated invariant in llcp_lr_check_done() / llcp_rr_... is hit, resulting in an assertion and controller crash/DoS. Impact is availability-only (C:N/I:N/A:H), scope unchanged, no confidentiality or integrity impact.

Impact Assessment

Business impact is availability-focused. Affected systems are devices embedding the Zephyr Bluetooth LE Controller with the LLCP PHY Update procedure enabled and default assert configuration. The blast radius is limited to devices within BLE radio range of an attacker (CVSS AV:A) and to an established LE connection, but the attack is deterministic, low-complexity (AC:L), and requires no privileges (PR:N) or user interaction (UI:N). CVSS subscores: no confidentiality impact (C:N), no integrity impact (I:N), high availability impact (A:H), scope unchanged (S:U). No KEV listing, no public PoC, and no evidence of in-the-wild exploitation at time of writing.

Detection Guidance

Sigma Rule

title: Zephyr BLE LLCP PHY Update Invalid-PDU Retained Node Assertion
id: 8f2c1a44-9d3e-4b71-9f0a-3c7e5b1d2a90
status: experimental
description: Detects assertion/crash in the Zephyr BLE Controller LLCP path associated with CVE-2026-19740 (retained RX node not released on invalid-PDU arms).
logsource:
  product: zephyr
  service: bluetooth_controller
detection:
  keywords_assert:
    - 'llcp_lr_check_done'
    - 'llcp_rr'
    - 'NODE_RX_TYPE_RETAIN'
    - 'LL_PHY_UPDATE_IND'
  keywords_pdu:
    - 'llcp_lp_pu_rx'
    - 'llcp_rp_pu_rx'
    - 'llcp_rx_node_retain'
  condition: keywords_assert and keywords_pdu
level: high

YARA Rule

rule CVE_2026_19740_Zephyr_LLCP_Retained_Node
{
    meta:
        description = "Detects Zephyr BLE Controller LLCP PHY Update retained-node handling tied to CVE-2026-19740"
        cve = "CVE-2026-19740"
        cwe = "CWE-401"
    strings:
        $a = "NODE_RX_TYPE_RETAIN" ascii
        $b = "llcp_rx_node_retain" ascii
        $c = "llcp_lr_complete" ascii
        $d = "llcp_rr_complete" ascii
        $e = "LL_PHY_UPDATE_IND" ascii
        $f = "llcp_lr_check_done" ascii
    condition:
        uint32(0) == 0x464c457f and 3 of them
}

Suricata IDS Rule

alert bluetooth any any -> any any (msg:"CVE-2026-19740 Zephyr BLE LLCP PHY Update invalid-PDU retained node"; flow:to_client; content:"|04|"; depth:1; content:"|18|"; within:1; classtype:attempted-dos; reference:cve,CVE-2026-19740; sid:2026197401; rev:1;)

Note: BLE link-layer control PDUs (LL_PHY_UPDATE_IND opcode 0x18) are only observable with a BLE-aware capture stack; this rule targets passive link-layer monitoring deployments.

Elastic Detection

process where event.category == "process" and process.name == "zephyr-controller"
and process.exit_code != 0
and (
  process.args : "*llcp_lr_check_done*" or
  process.args : "*NODE_RX_TYPE_RETAIN*" or
  process.args : "*llcp_rx_node_retain*"
)

Splunk SPL Query

index=embedded_logs (sourcetype=zephyr:controller OR sourcetype=bluetooth:le)
("llcp_lr_check_done" OR "llcp_rr" OR "NODE_RX_TYPE_RETAIN" OR "llcp_rx_node_retain")
("LL_PHY_UPDATE_IND" OR "llcp_lp_pu_rx" OR "llcp_rp_pu_rx")
| stats count min(_time) as first_seen max(_time) as last_seen by host, src_mac
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="zephyr,bluetooth,llcp">
  <rule id="100740" level="12">
    <decoded_as>zephyr-controller</decoded_as>
    <match>NODE_RX_TYPE_RETAIN|llcp_lr_check_done|llcp_rx_node_retain</match>
    <description>CVE-2026-19740: Zephyr BLE LLCP retained RX node invariant violation / assertion</description>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Disable the PHY Update procedure capability where product requirements permit, reducing exposure to the LL_PHY_UPDATE_IND path. Where supported and operationally acceptable, disable the assert path (CONFIG_BT_ASSERT / CONFIG_BT_CTLR_ASSERT_DEBUG) so the violated invariant does not produce a hard crash — note this trades DoS-via-assert for potential undefined behaviour and is not a complete fix. Isolate or RF-shield exposed BLE devices and monitor for anomalous LL Control PDU sequences (LL_PHY_REQ/LL_PHY_RSP/LL_PHY_UPDATE_IND followed by an unexpected control PDU such as LL_LENGTH_REQ before the update instant).

2. Patch/upgrade steps: No vendor patch is available from any tracked source. Track the Zephyr project’s repository commits for subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c (llcp_lp_pu_rx(), llcp_rp_pu_rx()) and ull_llcp.c (llcp_rx_node_retain()) and apply the upstream fix once released. Upgrade to the first Zephyr release containing a corrected invalid-PDU arm that releases the retained node before calling llcp_lr_complete() / llcp_rr_complete().

3. Long-term hardening: Audit all LLCP procedure-completion paths for symmetric release of retained receive nodes; enforce static analysis or fuzzing of link-layer control PDU sequences, including invalid-PDU arms; and review assert strategy for controller firmware so that invariant violations degrade gracefully rather than crashing.

References

• NVD — CVE-2026-19740: https://nvd.nist.gov/vuln/detail/CVE-2026-19740
• Zephyr Project — Bluetooth Controller source (subsys/bluetooth/controller/ll_sw/ull_llcp.c, ull_llcp_phy.c): https://github.com/zephyrproject-rtos/zephyr
• CWE-401 — Missing Release of Memory after Effective Lifetime: https://cwe.mitre.org/data/definitions/401.html
• FIRST — EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (no KEV entry for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog