Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19738— Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 在为创建连接等时流（Connected Isochronous Stream, CIS）而实现的蓝牙链路层控制过程（Link Layer Control Procedure, LLCP）中，会保留一个接收节点（ctx->node_ref.rx，标记为 NODE_RX_TYPE_RETAIN），以便稍后将其作为主机通知重新使用。具体而言，在从设备（peripheral）端等待主机对 LL_CIS_REQ 的回复期间，以及在主设备（central）端发起本地 CIS 创建的整个持续期间

CVSS 6.5 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 3.4.0< 4.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19738

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
Source: CVE Program / CVE List V5
Vulnerability Description
The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LL_CIS_REQ, and on the central for the whole duration of a locally initiated CIS Create. In subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c, the "invalid PDU received" paths of llcp_rp_cc_rx() and llcp_lp_cc_rx() terminated the connection and completed the procedure without releasing that retained node, breaking the invariant checked in llcp_lr_check_done() and llcp_rr_check_done() and orphaning the node's memory. A peer device within radio range can reach this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link. Against a peripheral, the attacker sends a valid LL_CIS_REQ and then, before the Host replies, any unrelated LL Control PDU (for example LL_VERSION_IND), which ull_cp_rx() routes into the active remote procedure. Against a central performing a CIS Create, a malicious peripheral answers with LL_UNKNOWN_RSP for CIS_REQ, which is dispatched into the active local procedure. No pairing, encryption or user interaction is required; the code is compiled in when CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is enabled. In default builds (CONFIG_BT_CTLR_ASSERT_DEBUG is default y) the retained-node assertion fires immediately, producing a controller fatal error and, typically, a system reset from one injected PDU. With the development assertions disabled, each attempt permanently loses one node from the controller's small LL notification pool (LL_PDU_RX_CNT, 2 * CONFIG_BT_CTLR_LLCP_CONN) together with its memq_link_t; repeating the connect-attack-reconnect cycle exhausts the pool, after which notification allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults. The impact is limited to availability — the leaked node is orphaned, never reused or double-freed — and recovery requires a reboot.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.4.0 ~ 4.5.0 -

II. Public POCs for CVE-2026-19738

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19738

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-19738 (1)

Vendor Advisories for CVE-2026-19738 (1)

Same Patch Batch · zephyrproject · 2026-10-11 · 11 CVEs total

CVE-2026-19736 7.8 HIGH Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request leng
CVE-2026-19669 7.8 HIGH Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overfl
CVE-2026-19935 7.5 HIGH Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item i
CVE-2026-19577 7.1 HIGH Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer ad
CVE-2026-19576 6.8 MEDIUM Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated
CVE-2026-19740 6.5 MEDIUM Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update p
CVE-2026-19739 6.5 MEDIUM Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives
CVE-2026-19737 5.5 MEDIUM NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
CVE-2026-19735 4.8 MEDIUM Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails sil
CVE-2026-18418 3.4 LOW Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's chan

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-401

V. Comments for CVE-2026-19738

No comments yet

Leave a comment