CVE-2026-19739: dos in zephyrproject zephyr

The vulnerability exists in the Bluetooth Link Layer control procedure code in Zephyr's controller, specifically in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c. When a Connection Update or Connection Parameter procedure waits for its instant, the received RX node is retained for later host notification. However, if an invalid PDU is received during this state, the procedure completes without releasing the retained node, causing a reference to a retained node to be dropped improperly. This leads to either an assertion failure (if debug asserts are enabled) causing a fatal error, or a leak of RX nodes from the controller's fixed RX buffer pool. An attacker can exploit this by sending a crafted sequence of LL control PDUs, causing denial of service by exhausting RX buffers or triggering a fatal error. The vulnerability can be exploited without authentication or encryption and affects both peripheral and central roles.

An unauthenticated remote attacker within radio range can cause a denial of service condition on affected Zephyr Bluetooth controllers by triggering either a fatal error or exhaustion of the RX buffer pool. This results in the link-layer receive path operating on a NULL node, effectively disabling Bluetooth communication until the device is rebooted. There is no impact on confidentiality or integrity, as no memory corruption or data disclosure occurs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling CONFIG_BT_CTLR_ASSERT_DEBUG to avoid fatal errors, though this will cause RX buffer exhaustion instead. Monitor vendor communications for official patches or updates addressing this issue.