CVE-2026-19738

The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node ref.rx, marked NODE RX TYPE RETAIN) so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LL CIS REQ, and on the central for the whole duration of a locally initiated CIS Create. In subsys/bluetooth/controller/ll sw/ull llcp cc.c, the "invalid PDU received" paths of llcp rp cc rx() and llcp lp cc rx() terminated the connection and completed the procedure without releasing that retained node, breaking the invariant checked in llcp lr check done() and llcp rr check done() and orphaning the node's memory.

A peer device within radio range can reach this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link. Against a peripheral, the attacker sends a valid LL CIS REQ and then, before the Host replies, any unrelated LL Control PDU (for example LL VERSION IND), which ull cp rx() routes into the active remote procedure. Against a central performing a CIS Create, a malicious peripheral answers with LL UNKNOWN RSP for CIS REQ, which is dispatched into the active local procedure. No pairing, encryption or user interaction is required; the code is compiled in when CONFIG BT CTLR PERIPHERAL ISO or CONFIG BT CTLR CENTRAL ISO is enabled.

In default builds (CONFIG BT CTLR ASSERT DEBUG is default y) the retained-node assertion fires immediately, producing a controller fatal error and, typically, a system reset from one injected PDU. With the development assertions disabled, each attempt permanently loses one node from the controller's small LL notification pool (LL PDU RX CNT, 2 * CONFIG BT CTLR LLCP CONN) together with its memq link t; repeating the connect-attack-reconnect cycle exhausts the pool, after which notification allocation always fails, RX flow control stalls, and the non-disableable LL ASSERT ERR() in llcp lp cc flush() faults. The impact is limited to availability — the leaked node is orphaned, never reused or double-freed — and recovery requires a reboot.