# CVE-2026-19740: Zephyr Bluetooth LE Controller LLCP receive node leak

Source: https://junglewise.ai/threats/cve-2026-19740-the-link-layer-control-procedure-llcp-implementation-of-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19740 · Severity: medium · CVSS 6.5 · Published 2026-10-11

The Zephyr software Bluetooth LE Controller contains a flaw in its Link Layer Control Procedure (LLCP) implementation that allows a nearby attacker to trigger memory leaks or crash the device via malformed Bluetooth packets. By sending a sequence of specially crafted wireless frames to an established connection, an attacker can exhaust the controller's limited receive buffer pool, rendering Bluetooth non-functional until the device is rebooted.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-19740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19740 being exploited in the wild.

**How severe is CVE-2026-19740?** Medium severity, with a CVSS score of 6.5, published 11 October 2026.

**Which products and versions are affected?** Zephyr RTOS 3.4.0 through 3.7.x and later.

**Is there a fix for CVE-2026-19740?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19740 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-19740?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The LLCP implementation in subsys/bluetooth/controller/ll_sw/ull_llcp.c and ull_llcp_phy.c retains received PDU nodes during PHY Update (and Connection Update, CIS-create) procedures but fails to release them when handling invalid PDUs; this causes orphaned nodes to accumulate outside the receive pool. An unauthenticated peer on an established LE connection can trigger this deterministically by sending a valid LL_PHY_UPDATE_IND followed by an out-of-order control PDU before the update instant, causing either a controller assertion (default config) or silent per-attempt leaks of one receive buffer. With the small default receive pool (CONFIG_BT_CTLR_RX_BUFFERS=1), repeated attacks exhaust buffers and disable Bluetooth until reboot.

## Affected products

- Zephyr Zephyr RTOS 3.4.0 through 3.7.x and later

## Timeline

- 2026-10-11: disclosed

## Related threats

- [Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys)
- [Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread)
- [Zephyr HTTP/2 server NULL pointer dereference in stream binding](https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c)
- [Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio)
- [Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system)