CVE-2026-19738: Zephyr Project Bluetooth Link Layer Control Procedure memory leak in CIS creation

CVE-2026-19738 · Severity: medium · CVSS 6.5 · Published 2026-10-11

Zephyr's Bluetooth controller implementation has a memory leak in the Link Layer Control Procedure when establishing Connected Isochronous Streams. An attacker within radio range can trigger the leak by sending specially crafted Bluetooth control messages to an unauthenticated device, requiring no pairing or encryption. Repeated attacks exhaust the controller's memory pool, causing Bluetooth reception to fail and forcing a system reboot.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19738 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19738 being exploited in the wild.
How severe is CVE-2026-19738?
Medium severity, with a CVSS score of 6.5, published 11 October 2026.
Which products and versions are affected?
Zephyr Project Zephyr OS versions with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO enabled.
Is there a fix for CVE-2026-19738?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19738 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-19738?
Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a resource leak in subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c: the llcp_rp_cc_rx() and llcp_lp_cc_rx() functions fail to release a retained RX node when handling invalid LL Control PDUs during CIS creation, violating node management invariants. An unauthenticated adjacent attacker can trigger this via a valid LL_CIS_REQ followed by an unrelated LL Control PDU (on peripheral), or an LL_UNKNOWN_RSP reply (on central), leaking one node per attack and eventually exhausting the pool.

Affected products

  • Zephyr Project Zephyr OS versions with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO enabled

Timeline

  • 2026-10-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.