CVE-2026-19739: Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update

The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/llsw/ullllcpconnupd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notification (llcprxnoderetain(), which marks it NODERXTYPERETAIN and thereby suppresses the normal recycling in ull.c). The default: arm of llcprpcurx() and llcplpcurx() — the "invalid PDU, terminate the connection" path — completed the procedure without releasing that retained node. llcprrcheckdone() then dequeued and freed the procedure context with ctx->noderef.rx still pointing at the retained node, dropping the last reference to it.

A peer device in radio range can reach this without pairing, bonding, or encryption. Against a peripheral, the peer sends a well-formed LLCONNECTIONUPDATEIND with an instant a few connection events in the future (the node is retained and the procedure enters RPCUSTATEWAITINSTANT), then, before the instant is reached, sends any other LL Control PDU such as LLLENGTHREQ. ullcprx() routes that PDU into the active remote Connection Update procedure, which takes the invalid-PDU path. The central role is reachable symmetrically after accepting an LLCONNECTIONPARAMREQ, and the local-procedure variant is reachable with LLREJECTIND.

With CONFIGBTCTLRASSERTDEBUG enabled (its default), the resulting state violates the invariant asserted in llcprrcheckdone(), so the two-PDU sequence produces an immediate fatal error in the controller. With those asserts disabled, each occurrence permanently loses one node from the controller's small fixed RX pool (sized from CONFIGBTCTLRRXBUFFERS, which defaults to 1); repeating the sequence across reconnections exhausts the pool, after which the link-layer receive path operates on a NULL node. The impact is an unauthenticated, remotely triggerable denial of service persisting until reboot; there is no memory-disclosure or memory-corruption consequence, since the leaked node simply becomes unreachable.