CVE-2026-19740 zephyrproject CVE debrief

Who should care

Bluetooth LE device manufacturers and users, Zephyr software users and developers, and security teams responsible for Bluetooth LE device management should be aware of this vulnerability and take necessary precautions to prevent potential exploitation. This includes verifying and applying patches, monitoring Bluetooth LE connections for suspicious activity, and upgrading to a fixed version of the Zephyr software if necessary. Additionally, operators and

Why it matters

This vulnerability affects Bluetooth LE devices using the Zephyr software, allowing a peer device on an established LE connection to potentially exploit the retained RX node leak and reachable assertion in the PHY Update procedure.

• Verify and apply patches to prevent potential exploitation
• Monitor Bluetooth LE connections for suspicious activity
• Upgrade to a fixed version of the Zephyr software if necessary

Technical summary

The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the update instant is reached. However, the invalid-PDU arms of llcp_lp_pu_rx() and llcp_rp_pu_rx() completed the procedure via llcp_lr_complete() / llcp_rr_complete() without first releasing that retained node, leading to a potential vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Verify the affected versions and upgrade to a fixed version if necessary
• Monitor Bluetooth LE connections for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on a Bluetooth LE Controller vulnerability in the Zephyr software. The vulnerability is related to a retained RX node leak and reachable assertion in the PHY Update procedure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.