CVE-2026-19740

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.4.0 through 3.7.x

Description The Link Layer Control Procedure (LLCP) implementation of the Bluetooth LE Controller fails to release a retained receive node when processing invalid Protocol Data Units (PDUs) during PHY Update, Connection Update, and CIS-create procedures. Specifically, the functions llcp lp pu rx() and llcp rp pu rx() complete the procedure via llcp lr complete() or llcp rr complete() without releasing the node held by llcp rx node retain().

A remote peer on an established LE connection can trigger this behavior without pairing or encryption by sending a valid LL PHY UPDATE IND followed by an incompatible LL Control PDU, such as LL LENGTH REQ, before the update instant is reached. Depending on the configuration, this leads to either a controller assertion resulting in a system crash (k oops() or k panic()) or a silent memory leak of receive PDU nodes. Because the receive pool is small, repeated attempts can exhaust available resources, rendering Bluetooth inoperable until the device is rebooted.

Recommendations Update Zephyr to a version later than 3.7.x. As a temporary mitigation, restrict the use of the llcp lp pu rx() and llcp rp pu rx() functions by limiting the types of LL Control PDUs accepted during active PHY Update procedures.