CVE-2026-87040 Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write

The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio. isrrxpdu in subsys/bluetooth/controller/llsw/nordic/lll/lllconn.c enqueued any non-empty da...