Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19739— Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

这段描述涉及蓝牙控制器（Bluetooth Controller）软件中链路层（Link Layer）控制程序的一个内存管理漏洞，可能导致拒绝服务（DoS）。以下是该漏洞描述信息的中文翻译： --- 在 中，蓝牙链路层控制程序的代码在等待连接更新（Connection Update）或连接参数更新（Connection Parameter）指令生效的“即刻时间”（instant）期间，会保留接收到的 RX 节点。该节点随后可用于承载主机通知（通过 函数标记为 ，从而抑制 中的正常回收机制）。 和 函数的默认分支——

CVSS 6.5 · Medium EPSS 0.10% · P1

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 3.4.0< 4.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19739

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
Source: CVE Program / CVE List V5
Vulnerability Description
The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notification (llcp_rx_node_retain(), which marks it NODE_RX_TYPE_RETAIN and thereby suppresses the normal recycling in ull.c). The default: arm of llcp_rp_cu_rx() and llcp_lp_cu_rx() — the "invalid PDU, terminate the connection" path — completed the procedure without releasing that retained node. llcp_rr_check_done() then dequeued and freed the procedure context with ctx->node_ref.rx still pointing at the retained node, dropping the last reference to it. A peer device in radio range can reach this without pairing, bonding, or encryption. Against a peripheral, the peer sends a well-formed LL_CONNECTION_UPDATE_IND with an instant a few connection events in the future (the node is retained and the procedure enters RP_CU_STATE_WAIT_INSTANT), then, before the instant is reached, sends any other LL Control PDU such as LL_LENGTH_REQ. ull_cp_rx() routes that PDU into the active remote Connection Update procedure, which takes the invalid-PDU path. The central role is reachable symmetrically after accepting an LL_CONNECTION_PARAM_REQ, and the local-procedure variant is reachable with LL_REJECT_IND. With CONFIG_BT_CTLR_ASSERT_DEBUG enabled (its default), the resulting state violates the invariant asserted in llcp_rr_check_done(), so the two-PDU sequence produces an immediate fatal error in the controller. With those asserts disabled, each occurrence permanently loses one node from the controller's small fixed RX pool (sized from CONFIG_BT_CTLR_RX_BUFFERS, which defaults to 1); repeating the sequence across reconnections exhausts the pool, after which the link-layer receive path operates on a NULL node. The impact is an unauthenticated, remotely triggerable denial of service persisting until reboot; there is no memory-disclosure or memory-corruption consequence, since the leaked node simply becomes unreachable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.4.0 ~ 4.5.0 -

II. Public POCs for CVE-2026-19739

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19739

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-19739 (1)

Vendor Advisories for CVE-2026-19739 (1)

Same Patch Batch · zephyrproject · 2026-10-11 · 11 CVEs total

CVE-2026-19736 7.8 HIGH Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request leng
CVE-2026-19669 7.8 HIGH Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overfl
CVE-2026-19935 7.5 HIGH Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item i
CVE-2026-19577 7.1 HIGH Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer ad
CVE-2026-19576 6.8 MEDIUM Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated
CVE-2026-19740 6.5 MEDIUM Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update p
CVE-2026-19738 6.5 MEDIUM Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedure
CVE-2026-19737 5.5 MEDIUM NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
CVE-2026-19735 4.8 MEDIUM Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails sil
CVE-2026-18418 3.4 LOW Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's chan

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-401

V. Comments for CVE-2026-19739

No comments yet

Leave a comment