Zephyr RTOS EUVD-2026-97108

Requires the target to be a Zephyr device running the BLE Link Layer controller (ull_llcp_conn_upd.c) and reachable over the air within Bluetooth radio range; no pairing, bonding, or encryption is needed. The specific trigger is an active Connection Update / Connection Parameter procedure left waiting for its instant (RP_CU_STATE_WAIT_INSTANT) - reached against a peripheral via LL_CONNECTION_UPDATE_IND, against a central after it accepts LL_CONNECTION_PARAM_REQ, or via the local-procedure variant with LL_REJECT_IND - followed by any other LL Control PDU before the instant is reached. Limiting factors: exploitation is confined to Bluetooth proximity (not remote/Internet), impact is DoS only and clears on reboot, and the immediate-crash behavior depends on CONFIG_BT_CTLR_ASSERT_DEBUG being enabled (its default); with it disabled, impact requires repeated sequences to exhaust the small RX pool (CONFIG_BT_CTLR_RX_BUFFERS, default 1).

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: AV:A reflects that the attacker must be within Bluetooth radio range, PR:N/UI:N reflect that no pairing, bonding, encryption, or user interaction is needed, and the C:N/I:N/A:H profile matches a pure denial-of-service with no disclosure or corruption. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing, no EPSS probability was provided, and no standalone proof-of-concept is referenced; the vendor did ship regression tests reproducing the two-PDU sequence, which lowers the bar for weaponization but is not itself an exploit in the wild. The practical ceiling on risk is the adjacency requirement (Bluetooth range, not Internet-reachable) and the DoS-only impact: with CONFIG_BT_CTLR_ASSERT_DEBUG at its default, a single two-PDU sequence crashes the controller, and with asserts disabled the fixed RX pool (CONFIG_BT_CTLR_RX_BUFFERS default 1) is exhausted quickly across reconnections - reliable and low-complexity, but recoverable by reboot. Net: a real patch-worthy issue for exposed BLE peripherals/centrals, not an emergency on the level of a remote-code-execution flaw. No SSVC decision data was supplied, so automatable/technical-impact framing cannot be cross-referenced.

An attacker within Bluetooth range of a Zephyr-based device sends a well-formed LL_CONNECTION_UPDATE_IND with an instant a few connection events in the future, causing the controller to retain an RX node while awaiting that instant. Before the instant arrives the attacker sends any other LL Control PDU (e.g. LL_LENGTH_REQ), driving the active Connection Update procedure down the invalid-PDU termination path and leaking the retained node. No public exploit is published, though the vendor's committed regression tests demonstrate the exact triggering sequence.