CVE-2026-19739

The Bluetooth LE controller contains a resource leak in the Link Layer control procedure located in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c. When a device receives a Connection Update or Connection Parameter procedure and subsequently receives an unexpected LL Control PDU before the...

CVE-2026-19738

The Bluetooth Link Layer Control Procedure (LLCP) implementation in Zephyr RTOS contains a memory leak and reachable assertion during Connected Isochronous Stream (CIS) creation. Specifically, in subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c, the "invalid PDU received" paths of llcp_rp_cc_rx() ...