CVE-2026-19739

The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll sw/ull llcp conn upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notification (llcp rx node retain(), which marks it NODE RX TYPE RETAIN and thereby suppresses the normal recycling in ull.c). The default: arm of llcp rp cu rx() and llcp lp cu rx() — the "invalid PDU, terminate the connection" path — completed the procedure without releasing that retained node. llcp rr check done() then dequeued and freed the procedure context with ctx->node ref.rx still pointing at the retained node, dropping the last reference to it.

A peer device in radio range can reach this without pairing, bonding, or encryption. Against a peripheral, the peer sends a well-formed LL CONNECTION UPDATE IND with an instant a few connection events in the future (the node is retained and the procedure enters RP CU STATE WAIT INSTANT), then, before the instant is reached, sends any other LL Control PDU such as LL LENGTH REQ. ull cp rx() routes that PDU into the active remote Connection Update procedure, which takes the invalid-PDU path. The central role is reachable symmetrically after accepting an LL CONNECTION PARAM REQ, and the local-procedure variant is reachable with LL REJECT IND.

With CONFIG BT CTLR ASSERT DEBUG enabled (its default), the resulting state violates the invariant asserted in llcp rr check done(), so the two-PDU sequence produces an immediate fatal error in the controller. With those asserts disabled, each occurrence permanently loses one node from the controller's small fixed RX pool (sized from CONFIG BT CTLR RX BUFFERS, which defaults to 1); repeating the sequence across reconnections exhausts the pool, after which the link-layer receive path operates on a NULL node. The impact is an unauthenticated, remotely triggerable denial of service persisting until reboot; there is no memory-disclosure or memory-corruption consequence, since the leaked node simply becomes unreachable.