{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-19738 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-19738 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-19738 is a medium-severity memory corruption vulnerability in zephyrproject zephyr, published on 11 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-19738 and fix it if it is affected.\n\nWhat it is: CVE-2026-19738 is a medium-severity memory corruption vulnerability in zephyrproject zephyr, published on 11 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-19738 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-19738/ (Markdown: https://insights.sbomify.com/CVE-2026-19738/index.md)","id":"CVE-2026-19738","markdown":"https://insights.sbomify.com/CVE-2026-19738/index.md","name":"CVE-2026-19738","record":{"aliases":["GHSA-6mcj-5jw8-ff36"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Zephyr RTOS Bluetooth","requires_auth":"none","summary":"A remote attacker can cause a denial of service in Zephyr RTOS Bluetooth controllers by leaking memory nodes via malformed CIS control PDUs.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-401","name":"Missing Release of Memory after Effective Lifetime"}],"description":"The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx-\u003enode_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LL_CIS_REQ, and on the central for the whole duration of a locally initiated CIS Create. In subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c, the \"invalid PDU received\" paths of llcp_rp_cc_rx() and llcp_lp_cc_rx() terminated the connection and completed the procedure without releasing that retained node, breaking the invariant checked in llcp_lr_check_done() and llcp_rr_check_done() and orphaning the node's memory.\n\nA peer device within radio range can reach this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link. Against a peripheral, the attacker sends a valid LL_CIS_REQ and then, before the Host replies, any unrelated LL Control PDU (for example LL_VERSION_IND), which ull_cp_rx() routes into the active remote procedure. Against a central performing a CIS Create, a malicious peripheral answers with LL_UNKNOWN_RSP for CIS_REQ, which is dispatched into the active local procedure. No pairing, encryption or user interaction is required; the code is compiled in when CONFIG_BT_CTLR_PERIPHERAL_ISO or CONFIG_BT_CTLR_CENTRAL_ISO is enabled.\n\nIn default builds (CONFIG_BT_CTLR_ASSERT_DEBUG is default y) the retained-node assertion fires immediately, producing a controller fatal error and, typically, a system reset from one injected PDU. With the development assertions disabled, each attempt permanently loses one node from the controller's small LL notification pool (LL_PDU_RX_CNT, 2 * CONFIG_BT_CTLR_LLCP_CONN) together with its memq_link_t; repeating the connect-attack-reconnect cycle exhausts the pool, after which notification allocation always fails, RX flow control stalls, and the non-disableable LL_ASSERT_ERR() in llcp_lp_cc_flush() faults. The impact is limited to availability — the leaked node is orphaned, never reused or double-freed — and recovery requires a reboot.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures","id":"CVE-2026-19738","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update","id":"CVE-2026-19739"},"packages":[],"prev":{"headline":"NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction","id":"CVE-2026-19737"},"products":["zephyr"],"published":"2026-10-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["zephyrproject"]},"summary":"A remote attacker can cause a denial of service in Zephyr RTOS Bluetooth controllers by leaking memory nodes via malformed CIS control PDUs.","url":"https://insights.sbomify.com/CVE-2026-19738/"}