# CVE-2026-19738: Zephyr Project Bluetooth Link Layer Control Procedure memory leak in CIS creation

Source: https://junglewise.ai/threats/cve-2026-19738-the-bluetooth-link-layer-control-procedure-llcp-implementation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19738 · Severity: medium · CVSS 6.5 · Published 2026-10-11

Zephyr's Bluetooth controller implementation has a memory leak in the Link Layer Control Procedure when establishing Connected Isochronous Streams. An attacker within radio range can trigger the leak by sending specially crafted Bluetooth control messages to an unauthenticated device, requiring no pairing or encryption. Repeated attacks exhaust the controller's memory pool, causing Bluetooth reception to fail and forcing a system reboot.

Technologies: [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-19738 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19738 being exploited in the wild.

**How severe is CVE-2026-19738?** Medium severity, with a CVSS score of 6.5, published 11 October 2026.

**Which products and versions are affected?** Zephyr Project Zephyr OS versions with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO enabled.

**Is there a fix for CVE-2026-19738?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19738 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-19738?** Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource leak in subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c: the llcp_rp_cc_rx() and llcp_lp_cc_rx() functions fail to release a retained RX node when handling invalid LL Control PDUs during CIS creation, violating node management invariants. An unauthenticated adjacent attacker can trigger this via a valid LL_CIS_REQ followed by an unrelated LL Control PDU (on peripheral), or an LL_UNKNOWN_RSP reply (on central), leaking one node per attack and eventually exhausting the pool.

## Affected products

- Zephyr Project Zephyr OS versions with CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO enabled

## Timeline

- 2026-10-11: disclosed

## Related threats

- [Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c)
- [Zephyr arm64 MMU TLB invalidation memory isolation bypass](https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from)
- [Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing](https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe)
- [CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet)
- [Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys)