CVE-2026-19738 Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures

The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-noderef.rx, marked NODERXTYPERETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the...

CVE-2026-19738

The Bluetooth Link Layer Control Procedure (LLCP) implementation in Zephyr RTOS contains a memory leak and reachable assertion during Connected Isochronous Stream (CIS) creation. Specifically, in subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c, the "invalid PDU received" paths of llcp_rp_cc_rx() ...