CVE-2026-87040

The open-source Bluetooth LE Controller contains a vulnerability in the nRF link-layer receive paths where it fails to validate the on-air LENGTH field of a received PDU against the maximum receive length programmed into the radio. Specifically, the isr_rx_pdu() function in lll_conn.c and handler...

CVE-2026-87040 Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write

The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio. isrrxpdu in subsys/bluetooth/controller/llsw/nordic/lll/lllconn.c enqueued any non-empty da...