CVE-2026-19738: Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->noderef.rx, marked NODERXTYPERETAIN) so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the central for the whole duration of a locally initiated CIS Create. In subsys/bluetooth/controller/llsw/ullllcpcc.c, the "invalid PDU received" paths of llcprpccrx() and llcplpccrx() terminated the connection and completed the procedure without releasing that retained node, breaking the invariant checked in llcplrcheckdone() and llcprrcheckdone() and orphaning the node's memory.
A peer device within radio range can reach this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link. Against a peripheral, the attacker sends a valid LLCISREQ and then, before the Host replies, any unrelated LL Control PDU (for example LLVERSIONIND), which ullcprx() routes into the active remote procedure. Against a central performing a CIS Create, a malicious peripheral answers with LLUNKNOWNRSP for CISREQ, which is dispatched into the active local procedure. No pairing, encryption or user interaction is required; the code is compiled in when CONFIGBTCTLRPERIPHERALISO or CONFIGBTCTLRCENTRALISO is enabled.
In default builds (CONFIGBTCTLRASSERTDEBUG is default y) the retained-node assertion fires immediately, producing a controller fatal error and, typically, a system reset from one injected PDU. With the development assertions disabled, each attempt permanently loses one node from the controller's small LL notification pool (LLPDURXCNT, 2 CONFIGBTCTLRLLCPCONN) together with its memqlinkt; repeating the connect-attack-reconnect cycle exhausts the pool, after which notification allocation always fails, RX flow control stalls, and the non-disableable LLASSERTERR() in llcplpccflush() faults. The impact is limited to availability — the leaked node is orphaned, never reused or double-freed — and recovery requires a reboot.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Reboot the system/controller to recover after the retained-node leak or controller fault.
Event History
Frequently Asked Questions
Which Bluetooth devices are exposed in each attack scenario?
A peripheral is exposed while it is awaiting the Host's reply to a valid LL_CIS_REQ. A central is exposed for the duration of a locally initiated CIS Create when communicating with a malicious peripheral.
What must an attacker be able to do to trigger the issue?
The attacker must be a peer device within Bluetooth radio range and interact over an unauthenticated, unencrypted ACL link. No privileges or user interaction are required.
What traffic triggers the vulnerable paths?
Against a peripheral, an attacker sends a valid LL_CIS_REQ and then an unrelated LL Control PDU, such as LL_VERSION_IND, before the Host replies. Against a central initiating CIS Create, a malicious peripheral responds to CIS_REQ with LL_UNKNOWN_RSP.