Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read…
Affects Zephyr Bluetooth LE Controller (nRF link layer) 1.6.0 up to 4.3.2 and 4.4.0 up to 4.5.0, mainly on unencrypted links. Fixed in 4.3.2 and 4.5.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.3.2, 4.5.0
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 4.3.2, 4.5.0. A source says this fix is incomplete.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure?/25Exposure: unknown (data gap). Advisories don't say whether default setups are affected
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.3/10CVSS 8.3
- No patch0/5No signal
What would change the score
- Would score about 63 if added to CISA KEV
- Would score about 58 if CISA's SSVC rates exploitation active
- Would score about 30 if advisories confirm default setups are exposed
CVE-2026-87040 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects zephyr; fixed in 4.3.2 and 4.5.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.29% · 21st percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 8/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 4.3.2, 4.5.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio. isr_rx_pdu() in subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c enqueued any non-empty data PDU after only the sequence-number and (for encrypted links) MIC checks, and the corresponding isr_rx() handlers in lll_central_iso.c, lll_peripheral_iso.c, lll_sync_iso.c and lll_scan_aux.c did the same for ISO and extended-advertising PDUs. The nRF radio stores the received header verbatim and truncates only the payload at PCNF1.MAXLEN, so a frame declaring more octets than were configured leaves a node buffer whose len field describes more data than the buffer holds. An attacker within radio range that can emit a hand-crafted link-layer PDU — for a connection, any peer that establishes an unencrypted LE connection to a connectable advertiser; for CONFIG_BT_CTLR_SYNC_ISO, any broadcaster the device is synchronised to — can set the length byte up to 255 while the controller has programmed a much smaller maximum (lll->dle.eff.max_rx_octets, which is 27 until a Data Length Update, or the negotiated cis_lll->rx.max_pdu). No pairing, authentication or user interaction is required. On encrypted links the CCM MIC check normally rejects such a frame first, so the exposure is on unencrypted traffic, which is why the added check is placed after decryption. The unchecked length reaches hci_acl_encode() in subsys/bluetooth/controller/hci/hci.c, which performs net_buf_add(buf, pdu_data->len) followed by a memcpy() of that many bytes out of the node_rx pool element. Because CONFIG_BT_CTLR_DATA_LENGTH_MAX and CONFIG_BT_BUF_ACL_RX_SIZE both default to 27, this is an out-of-bounds read of up to roughly 228 bytes past the received PDU and a corresponding out-of-bounds write past the HCI ACL buffer into neighbouring buffers of the same pool; the tailroom test in net_buf_simple_add() is only enforced when CONFIG_NET_BUF_HARDENING (or CONFIG_ASSERT) is enabled. On the ISO paths the same unchecked length makes isoal_rx_append_to_sdu() read past the ISO node buffer and emit adjacent controller RAM to the host as ISO data. The practical result is remote memory corruption and controller crashes, plus disclosure of controller memory into the host data path. The fix rejects any received PDU whose length exceeds the value that was used to configure the radio reception. Note that lll_sync.c (periodic advertising sync reception) was not changed and still enqueues received PDUs without an equivalent bound.
What to do
Upgrade to a fixed version: 4.3.2, 4.5.0.
A source says this fix is incomplete.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- zephyr
From 1.6.0 · fixed in 4.3.2; From 4.4.0 · fixed in 4.5.0
Evidence 2
- Advisory
- Patch
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-87040
Is CVE-2026-87040 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The controller accepts incoming Bluetooth LE packets whose length field is larger than the configured maximum receive length, so it reads and writes memory outside the intended buffer. The result can be memory corruption, controller crashes, and controller memory leaking into the host data path.Source: github.com
Which versions are affected by CVE-2026-87040?
zephyr: from 1.6.0 before 4.3.2; from 4.4.0 before 4.5.0.Source: cve.now feed data
Am I affected, and how do I check?
Zephyr Bluetooth LE Controller (nRF link layer) versions from 1.6.0 up to 4.3.2, and from 4.4.0 up to 4.5.0. The exposure is mainly on unencrypted traffic, because encrypted links normally reject such frames at the MIC check first. For ISO/broadcast paths, check whether the device is synchronised to a broadcaster and whether CONFIG_BT_CTLR_SYNC_ISO is enabled.Source: github.com
How do I fix CVE-2026-87040?
Upgrade to Zephyr 4.3.2 for the 4.3 line or 4.5.0 for the 4.5 line.Source: github.com
Is the fix complete?
The advisory describes the fix as partial, so the listed fixed versions may not close every affected path. The facts do not say which paths remain unfixed.Source: github.com