{"id":"CVE-2026-87040","kind":"vulnerability","aliases":["CVE-2026-87040"],"related":[],"title":"Zephyr Bluetooth LE Controller: unchecked packet length lets radio attackers corrupt memory","description":"The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio. isr_rx_pdu() in subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c enqueued any non-empty data PDU after only the sequence-number and (for encrypted links) MIC checks, and the corresponding isr_rx() handlers in lll_central_iso.c, lll_peripheral_iso.c, lll_sync_iso.c and lll_scan_aux.c did the same for ISO and extended-advertising PDUs. The nRF radio stores the received header verbatim and truncates only the payload at PCNF1.MAXLEN, so a frame declaring more octets than were configured leaves a node buffer whose len field describes more data than the buffer holds.\n\nAn attacker within radio range that can emit a hand-crafted link-layer PDU — for a connection, any peer that establishes an unencrypted LE connection to a connectable advertiser; for CONFIG_BT_CTLR_SYNC_ISO, any broadcaster the device is synchronised to — can set the length byte up to 255 while the controller has programmed a much smaller maximum (lll->dle.eff.max_rx_octets, which is 27 until a Data Length Update, or the negotiated cis_lll->rx.max_pdu). No pairing, authentication or user interaction is required. On encrypted links the CCM MIC check normally rejects such a frame first, so the exposure is on unencrypted traffic, which is why the added check is placed after decryption.\n\nThe unchecked length reaches hci_acl_encode() in subsys/bluetooth/controller/hci/hci.c, which performs net_buf_add(buf, pdu_data->len) followed by a memcpy() of that many bytes out of the node_rx pool element. Because CONFIG_BT_CTLR_DATA_LENGTH_MAX and CONFIG_BT_BUF_ACL_RX_SIZE both default to 27, this is an out-of-bounds read of up to roughly 228 bytes past the received PDU and a corresponding out-of-bounds write past the HCI ACL buffer into neighbouring buffers of the same pool; the tailroom test in net_buf_simple_add() is only enforced when CONFIG_NET_BUF_HARDENING (or CONFIG_ASSERT) is enabled. On the ISO paths the same unchecked length makes isoal_rx_append_to_sdu() read past the ISO node buffer and emit adjacent controller RAM to the host as ISO data. The practical result is remote memory corruption and controller crashes, plus disclosure of controller memory into the host data path.\n\nThe fix rejects any received PDU whose length exceeds the value that was used to configure the radio reception. Note that lll_sync.c (periodic advertising sync reception) was not changed and still enqueues received PDUs without an equivalent bound.","summary":"The open-source Bluetooth LE Controller does not check the length field of received link-layer packets against the maximum it configured for the radio. A nearby attacker can send a crafted packet that causes out-of-bounds reads and writes in controller memory, leading to crashes, memory corruption and disclosure of controller RAM to the host.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zephyr","fixed":["4.3.2","4.5.0"],"affected":">= 1.6.0, < 4.3.2; >= 4.4.0, < 4.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["bluetooth-le","embedded","firmware","nrf","runtime","zephyr"],"not_affected_if":["encrypted-only-links","no-iso-sync","non-zephyr-controller"],"how_to_check":"- Firmware built from Zephyr >= 1.6.0 and < 4.3.2, or >= 4.4.0 and < 4.5.0 with the open-source Bluetooth LE Controller (CONFIG_BT_CTLR) on nRF radios is affected; check the Zephyr version in your west manifest.\n- Confirm the file subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c in your tree lacks the added max_rx_octets length check (commit 8ca41216e8e4).\n- Also check whether CONFIG_BT_CTLR_SYNC_ISO, CIS/BIS or extended scanning are enabled: those ISO/extended-advertising paths were patched too.\n- Encrypted links are normally protected by the MIC check; unencrypted connections are the exposure.","fix":"Upgrade Zephyr to 4.3.2 (4.3 line) or 4.5.0. Fix commit 8ca41216e8e4 'Bluetooth: Controller: Discard PDU exceeding max length' rejects PDUs longer than the configured max RX length. Periodic advertising sync (lll_sync.c) was not changed and still has no equivalent bound.","status":"open","published_at":"2026-11-04T06:17:06+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","triaged_at":"2026-11-04T06:25:53+00:00","updated_at":"2026-11-04T06:26:35+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-04T06:25:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Zephyr Bluetooth LE Controller: unchecked packet length lets radio attackers corrupt memory","impact":"high","summary":"The open-source Bluetooth LE Controller does not check the length field of received link-layer packets against the maximum it configured for the radio. A nearby attacker can send a crafted packet that causes out-of-bounds reads and writes in controller memory, leading to crashes, memory corruption and disclosure of controller RAM to the host.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["zephyr","nrf","bluetooth-le","embedded","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote memory corruption, controller crash, and controller RAM disclosure to the host.","analyst_note":"Confirm the fixed versions and the patch commit from the linked Patch and vendor advisory pages; sources do not state fixed version numbers.","how_to_check":"- Check whether the device firmware uses the open-source Bluetooth LE Controller from the Nordic/Zephyr tree with `CONFIG_BT_CTLR` enabled\n- Look for `subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c` in the Zephyr source used to build the firmware\n- Check whether `CONFIG_BT_CTLR_SYNC_ISO` is enabled","plain_action":"","needs_analyst":true,"not_affected_if":["encrypted-only-links","no-iso-sync"],"who_is_affected":"Products built on the open-source Bluetooth LE Controller for nRF chips, such as Zephyr-based firmware. An attacker in radio range who can send crafted link-layer packets is the exposure; encrypted links are normally protected by the MIC check first, so the main exposure is unencrypted connections and ISO/extended advertising paths. The sources do not say which exact versions contain the patch beyond referencing a fix, and note that the periodic advertising sync path (lll_sync.c) was not changed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000884,"input_tokens":5061,"output_tokens":756,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and the patch commit from the linked Patch and vendor advisory pages; sources do not state fixed version numbers.","search":"'-2026':14A,17A '-87040':15A,18A '228':401C '255':271C '27':287C,388C 'acl':343C,382C,418C 'add':332C,351C,434C 'adjac':470C 'advertis':180C,250C,523C 'air':109C 'append':459C 'assert':445C 'attack':10A,57B,221C 'authent':302C 'aux.c':171C 'bluetooth':2A,21B,32B,100C 'bluetooth-l':20B 'bound':68B,395C,413C,537C 'broadcast':258C 'bt':253C,373C,380C 'buf':350C,352C,381C,432C,441C 'buffer':209C,218C,419C,422C,467C 'byte':268C,363C,402C 'caus':64B 'ccm':312C 'central':160C 'chang':528C 'check':37B,151C,314C,333C 'cis':296C 'config':252C,372C,379C,439C,444C 'configur':51B,205C,514C 'connect':238C,246C,249C 'control':4A,34B,73B,83B,102C,274C,471C,487C,492C 'correspond':154C,409C 'corrupt':11A,79B,485C 'craft':61B,231C 'crash':77B,488C 'ctlr':254C,374C 'cve':13A,16A 'data':138C,215C,290C,354C,375C,478C,497C 'declar':200C 'decrypt':337C 'default':386C 'describ':213C 'devic':260C 'disclosur':81B,490C 'dle.eff.max':282C 'element':370C 'embed':23B 'emit':227C,469C 'empti':137C 'enabl':447C 'encod':344C 'encrypt':148C,309C 'enforc':437C 'enqueu':133C,531C 'equival':536C 'establish':242C 'exceed':507C 'exposur':323C 'extend':179C 'extended-advertis':178C 'field':40B,111C,212C 'firmwar':24B 'first':320C 'fix':500C 'follow':356C 'frame':199C,319C 'hand':230C 'hand-craft':229C 'handler':157C 'harden':442C 'hci':342C,417C 'header':188C 'hold':219C 'host':87B,475C,496C 'interact':305C 'iso':176C,256C,450C,465C,477C 'iso.c':161C,164C,167C 'isoal':457C 'isr':128C,155C 'layer':45B,92C,234C 'le':3A,22B,33B,101C,245C 'lead':75B 'leav':206C 'len':211C,355C 'length':7A,39B,110C,120C,267C,291C,340C,376C,455C,506C 'let':8A 'link':44B,91C,149C,233C,310C 'link-lay':43B,90C,232C 'lll':159C,162C,165C,169C,281C,297C,520C 'make':456C 'mani':362C 'max':377C 'maximum':49B,118C,280C 'memcpi':359C 'memori':12A,74B,78B,484C,493C 'mic':150C,313C 'much':278C 'nearbi':56B 'negoti':295C 'neighbour':421C 'net':349C,431C,440C 'node':208C,367C,466C 'non':136C 'non-empti':135C 'normal':315C 'note':518C 'nrf':25B,89C,183C 'number':145C 'octet':202C,284C 'on-air':107C 'open':30B,98C 'open-sourc':29B,97C 'out-of-bound':65B,392C,410C 'packet':6A,46B,62B 'pair':301C 'past':403C,415C,463C 'path':94C,451C,498C 'payload':194C 'pcnf1.maxlen':196C 'pdu':115C,130C,139C,235C,299C,353C,406C,504C 'pdus':181C,533C 'peer':240C 'perform':348C 'period':522C 'peripher':163C 'place':335C 'plus':489C 'pool':369C,426C 'practic':480C 'program':125C,276C 'radio':9A,54B,127C,184C,223C,516C 'ram':84B,472C 'rang':224C 'reach':341C 'read':69B,396C,462C 'receiv':42B,93C,114C,119C,187C,405C,503C,532C 'recept':517C,525C 'reject':316C,501C 'remot':483C 'requir':307C 'result':481C 'rough':400C 'runtim':26B 'rx':129C,156C,283C,368C,383C,458C 'rx.max':298C 'scan':170C 'sdu':461C 'send':59B 'sequenc':144C 'sequence-numb':143C 'set':265C 'simpl':433C 'size':384C 'smaller':279C 'sourc':31B,99C 'still':530C 'store':185C 'subsys/bluetooth/controller/hci/hci.c':346C 'subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c':132C 'sync':166C,255C,524C 'sync.c':521C 'synchronis':262C 'tailroom':428C 'test':429C 'traffic':327C 'truncat':191C 'uncheck':5A,339C,454C 'unencrypt':244C,326C 'updat':292C 'use':123C,512C 'user':304C 'valid':105C 'valu':509C 'verbatim':189C 'whose':210C,505C 'within':222C 'without':534C 'write':71B,414C 'zephyr':1A,19A,27B","nicknames":[],"mitigations":[],"who_affected":"Firmware that uses Zephyr's open-source Bluetooth LE Controller on Nordic nRF radios, in Zephyr >= 1.6.0 < 4.3.2 and >= 4.4.0 < 4.5.0. An attacker in radio range can connect to an unencrypted connectable device (or broadcast to a device synced via CONFIG_BT_CTLR_SYNC_ISO) and send an oversized length byte, with no pairing needed, causing out-of-bounds read/write in controller buffers, crashes, and leaking controller RAM to the host. Encrypted-only links, and builds not using the Zephyr controller (e.g. vendor closed controllers), can skip it. Periodic advertising sync reception (lll_sync.c) was not changed by the fix.","tier":"B","verified":{"fix":{"at":"2026-11-04T06:26:35Z","by":"analyst","doc":"https://github.com/zephyrproject-rtos/zephyr/commit/8ca41216e8e47a018e52044992789b5011ac99aa","run_id":1637},"products":{"at":"2026-11-04T06:26:35Z","by":"analyst","doc":"https://github.com/zephyrproject-rtos/zephyr/commit/8ca41216e8e47a018e52044992789b5011ac99aa","run_id":1637},"how_to_check":{"at":"2026-11-04T06:26:35Z","by":"analyst","doc":"https://github.com/zephyrproject-rtos/zephyr/commit/8ca41216e8e47a018e52044992789b5011ac99aa","run_id":1637},"who_affected":{"at":"2026-11-04T06:26:35Z","by":"analyst","doc":"https://github.com/zephyrproject-rtos/zephyr/commit/8ca41216e8e47a018e52044992789b5011ac99aa","run_id":1637}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["zephyr"],"ptokens":["zephyr"],"labels":["bluetoothle","embedded","firmware","high","nrf","runtime","zephyr"],"campaign_type":null,"first_public_at":"2026-11-04T05:33:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87040","severity":null,"published_at":"2026-11-04T06:17:06+00:00","modified_at":"2026-11-04T06:17:06+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","fetched_at":"2026-11-04T06:25:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87040:1637","url":null,"severity":null,"published_at":"2026-11-04T06:26:35+00:00","modified_at":"2026-11-04T06:26:35+00:00","first_seen_at":"2026-11-04T06:26:35+00:00","fetched_at":"2026-11-04T06:26:35+00:00","note":"Read GHSA-grqr-q9fh-8ff2 and the commit: affected/fixed versions from the vendor advisory. No exploitation or public PoC stated (reporter's description includes repro details). Residual gap in lll_sync.c noted."}],"documents":[{"id":64658,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/8ca41216e8e47a018e52044992789b5011ac99aa","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":64659,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-grqr-q9fh-8ff2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T05:33:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}