CVE-2026-19738: dos in zephyrproject zephyr

The vulnerability exists in Zephyr's Bluetooth LLCP for CIS creation, where retained RX nodes (ctx->node_ref.rx) are not released on certain invalid PDU reception paths, violating internal invariants and orphaning memory nodes. This can be triggered by a peer device sending an extra LL Control PDU on an unauthenticated, unencrypted ACL link. On peripherals, sending a valid LL_CIS_REQ followed by an unrelated LL Control PDU before host reply triggers the issue. On centrals, a malicious peripheral sending LL_UNKNOWN_RSP for CIS_REQ causes the same effect. With default debug assertions enabled, this leads to immediate controller fatal errors and system resets. Without assertions, repeated exploitation exhausts the small LL notification pool, causing RX flow control stalls and faults. No pairing, encryption, or user interaction is required, and the vulnerability affects builds with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO enabled.

The vulnerability results in denial of service by exhausting controller resources or triggering fatal errors that cause system resets. It affects availability only, with no impact on confidentiality or integrity. Recovery requires rebooting the affected device. The attack can be performed remotely within radio range without authentication or encryption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, disabling CONFIG_BT_CTLR_PERIPHERAL_ISO and CONFIG_BT_CTLR_CENTRAL_ISO features, if feasible, may mitigate exposure. Devices should be rebooted to recover from the denial-of-service state after exploitation.