Description
The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notification (llcp_rx_node_retain(), which marks it NODE_RX_TYPE_RETAIN and thereby suppresses the normal recycling in ull.c). The default: arm of llcp_rp_cu_rx() and llcp_lp_cu_rx() — the "invalid PDU, terminate the connection" path — completed the procedure without releasing that retained node. llcp_rr_check_done() then dequeued and freed the procedure context with ctx->node_ref.rx still pointing at the retained node, dropping the last reference to it.

A peer device in radio range can reach this without pairing, bonding, or encryption. Against a peripheral, the peer sends a well-formed LL_CONNECTION_UPDATE_IND with an instant a few connection events in the future (the node is retained and the procedure enters RP_CU_STATE_WAIT_INSTANT), then, before the instant is reached, sends any other LL Control PDU such as LL_LENGTH_REQ. ull_cp_rx() routes that PDU into the active remote Connection Update procedure, which takes the invalid-PDU path. The central role is reachable symmetrically after accepting an LL_CONNECTION_PARAM_REQ, and the local-procedure variant is reachable with LL_REJECT_IND.

With CONFIG_BT_CTLR_ASSERT_DEBUG enabled (its default), the resulting state violates the invariant asserted in llcp_rr_check_done(), so the two-PDU sequence produces an immediate fatal error in the controller. With those asserts disabled, each occurrence permanently loses one node from the controller's small fixed RX pool (sized from CONFIG_BT_CTLR_RX_BUFFERS, which defaults to 1); repeating the sequence across reconnections exhausts the pool, after which the link-layer receive path operates on a NULL node. The impact is an unauthenticated, remotely triggerable denial of service persisting until reboot; there is no memory-disclosure or memory-corruption consequence, since the leaked node simply becomes unreachable.
Published: 2026-10-11
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A flaw in the Zephyr Bluetooth controller improperly retains a receive node when an unexpected LL Control PDU is received during a Connection Update procedure. The retained node remains marked as NODE_RX_TYPE_RETAIN and is never recycled, leading to a loss of a pool entry each time the sequence is triggered. The resulting denial of service manifests as a fatal error when asserts are enabled, or a permanent exhaustion of the fixed RX buffer pool when they are disabled. Attackers can trigger this condition by sending a carefully timed LL_CONNECTION_UPDATE_IND followed by any other LL Control PDU without requiring pairing, bonding, or encryption, causing the controller to crash or enter an invalid state until reboot.

Affected Systems

The vulnerability affects the Bluetooth Link Layer implementation in the Zephyr project’s Zephyr RTOS. No specific version range is published, but the issue resides in the source path subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c and can impact any Zephyr build that includes the current Bluetooth controller code until the patch committed on 7b600129faaba8bb26dd5cb3e8f17ed1cb41ea7f is applied.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity vulnerability. Exploitation requires only local wireless proximity and does not rely on authentication or encryption, meaning any nearby device can trigger the denial of service. While the EPSS score is not available, the lack of a CISA KEV listing suggests a lower current exploitation likelihood, yet the UNauthenticated, remote trigger remains a serious operational risk.

Generated by OpenCVE AI on October 11, 2026 at 18:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Zephyr patch that addresses the retained RX node bug (commit 7b600129faaba8bb26dd5cb3e8f17ed1cb41ea7f or any newer release that includes the fix).
  • After updating, reboot the device to clear any leaked nodes and ensure the controller starts with a fresh RX pool.
  • If an update cannot be performed immediately, disable the Bluetooth radio when the device is not actively used to reduce the window of opportunity for an attacker.

Generated by OpenCVE AI on October 11, 2026 at 18:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Sun, 11 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notification (llcp_rx_node_retain(), which marks it NODE_RX_TYPE_RETAIN and thereby suppresses the normal recycling in ull.c). The default: arm of llcp_rp_cu_rx() and llcp_lp_cu_rx() — the "invalid PDU, terminate the connection" path — completed the procedure without releasing that retained node. llcp_rr_check_done() then dequeued and freed the procedure context with ctx->node_ref.rx still pointing at the retained node, dropping the last reference to it. A peer device in radio range can reach this without pairing, bonding, or encryption. Against a peripheral, the peer sends a well-formed LL_CONNECTION_UPDATE_IND with an instant a few connection events in the future (the node is retained and the procedure enters RP_CU_STATE_WAIT_INSTANT), then, before the instant is reached, sends any other LL Control PDU such as LL_LENGTH_REQ. ull_cp_rx() routes that PDU into the active remote Connection Update procedure, which takes the invalid-PDU path. The central role is reachable symmetrically after accepting an LL_CONNECTION_PARAM_REQ, and the local-procedure variant is reachable with LL_REJECT_IND. With CONFIG_BT_CTLR_ASSERT_DEBUG enabled (its default), the resulting state violates the invariant asserted in llcp_rr_check_done(), so the two-PDU sequence produces an immediate fatal error in the controller. With those asserts disabled, each occurrence permanently loses one node from the controller's small fixed RX pool (sized from CONFIG_BT_CTLR_RX_BUFFERS, which defaults to 1); repeating the sequence across reconnections exhausts the pool, after which the link-layer receive path operates on a NULL node. The impact is an unauthenticated, remotely triggerable denial of service persisting until reboot; there is no memory-disclosure or memory-corruption consequence, since the leaked node simply becomes unreachable.
Title Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
Weaknesses CWE-401
CWE-459
CWE-617
CWE-772
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-11T17:15:06.540Z

Reserved: 2026-08-13T13:46:31.915Z

Link: CVE-2026-19739

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-11T18:16:59.170

Modified: 2026-10-11T18:16:59.170

Link: CVE-2026-19739

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T18:30:19Z

Weaknesses
  • CWE-401

    Missing Release of Memory after Effective Lifetime

  • CWE-459

    Incomplete Cleanup

  • CWE-617

    Reachable Assertion

  • CWE-772

    Missing Release of Resource after Effective Lifetime