CVE-2026-19740: dos in zephyrproject zephyr

The vulnerability exists in the LLCP implementation of Zephyr's Bluetooth LE Controller, where retained receive nodes for LL_PHY_UPDATE_IND PDUs are not properly released in certain invalid-PDU handling paths. Specifically, when an invalid PDU is received during an active PHY Update procedure, the procedure context is freed without releasing the retained node, causing a leak of the receive node and its memory queue link. An attacker on an established LE connection can deterministically trigger this by sending a sequence of LL Control PDUs (e.g., LL_PHY_REQ, LL_PHY_RSP, LL_PHY_UPDATE_IND, followed by another LL Control PDU before the update instant). This leak exhausts the controller's small receive pool (default size 1), causing Bluetooth to become non-functional until reboot. On versions 3.4.0 through 3.7.x, the assertion that would detect this condition is never reached, so the leak occurs silently regardless of configuration. The impact is limited to availability with no memory corruption or data disclosure. The same fix also addresses similar omissions in Connection Update and CIS-create procedures.

The vulnerability allows a remote attacker on an established Bluetooth LE connection to cause a denial of service by exhausting the controller's receive buffer pool. This leads to Bluetooth becoming inoperable until the device is rebooted. There is no memory corruption or information disclosure. The attack requires no pairing or encryption and can be performed deterministically. The impact is limited to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects Zephyr versions >=3.4.0 and <4.5.0. Users should monitor the Zephyr project advisories for an official fix. In the meantime, mitigating this issue may require limiting Bluetooth LE connections from untrusted devices or applying configuration options that enable controller assertions to detect the issue, although assertions do not prevent the leak in versions 3.4.0 through 3.7.x. Rebooting the device restores Bluetooth functionality after exhaustion occurs.