CVE-2026-19740: Zephyr Bluetooth LE Controller LLCP receive node leak

CVE-2026-19740 · Severity: medium · CVSS 6.5 · Published 2026-10-11

The Zephyr software Bluetooth LE Controller contains a flaw in its Link Layer Control Procedure (LLCP) implementation that allows a nearby attacker to trigger memory leaks or crash the device via malformed Bluetooth packets. By sending a sequence of specially crafted wireless frames to an established connection, an attacker can exhaust the controller's limited receive buffer pool, rendering Bluetooth non-functional until the device is rebooted.

Technologies: Zephyr RTOS. Vendors: Zephyr.

Quick answers

Is CVE-2026-19740 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19740 being exploited in the wild.
How severe is CVE-2026-19740?
Medium severity, with a CVSS score of 6.5, published 11 October 2026.
Which products and versions are affected?
Zephyr RTOS 3.4.0 through 3.7.x and later.
Is there a fix for CVE-2026-19740?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19740 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-19740?
Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The LLCP implementation in subsys/bluetooth/controller/ll_sw/ull_llcp.c and ull_llcp_phy.c retains received PDU nodes during PHY Update (and Connection Update, CIS-create) procedures but fails to release them when handling invalid PDUs; this causes orphaned nodes to accumulate outside the receive pool. An unauthenticated peer on an established LE connection can trigger this deterministically by sending a valid LL_PHY_UPDATE_IND followed by an out-of-order control PDU before the update instant, causing either a controller assertion (default config) or silent per-attempt leaks of one receive buffer. With the small default receive pool (CONFIG_BT_CTLR_RX_BUFFERS=1), repeated attacks exhaust buffers and disable Bluetooth until reboot.

Affected products

  • Zephyr Zephyr RTOS 3.4.0 through 3.7.x and later

Timeline

  • 2026-10-11: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.