CVE-2026-87040

Name of the Vulnerable Software and Affected Versions Open-source Bluetooth LE Controller (affected versions not specified)

Description The nRF link-layer receive paths fail to validate the on-air LENGTH field of a received Protocol Data Unit (PDU) against the maximum receive length programmed into the radio. This occurs in the isr rx pdu() function within subsys/bluetooth/controller/ll sw/nordic/lll/lll conn.c, as well as isr rx() handlers in lll central iso.c, lll peripheral iso.c, lll sync iso.c, and lll scan aux.c for ISO and extended-advertising PDUs.

An attacker within radio range can send a hand-crafted link-layer PDU with a length byte up to 255, exceeding the programmed maximum (such as lll->dle.eff.max rx octets or cis lll->rx.max pdu). This issue primarily affects unencrypted traffic as encrypted links typically reject such frames via MIC checks. The unchecked length is processed by hci acl encode() in subsys/bluetooth/controller/hci/hci.c, leading to an out-of-bounds read of approximately 228 bytes and a subsequent out-of-bounds write into neighboring buffers. Additionally, on ISO paths, isoal rx append to sdu() may read past the ISO node buffer. This can result in remote memory corruption, controller crashes, and the disclosure of controller memory to the host data path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.