CVE-2026-87040: Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write
The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio. isrrxpdu() in subsys/bluetooth/controller/llsw/nordic/lll/lllconn.c enqueued any non-empty data PDU after only the sequence-number and (for encrypted links) MIC checks, and the corresponding isrrx() handlers in lllcentraliso.c, lllperipheraliso.c, lllsynciso.c and lllscanaux.c did the same for ISO and extended-advertising PDUs. The nRF radio stores the received header verbatim and truncates only the payload at PCNF1.MAXLEN, so a frame declaring more octets than were configured leaves a node buffer whose len field describes more data than the buffer holds.
An attacker within radio range that can emit a hand-crafted link-layer PDU — for a connection, any peer that establishes an unencrypted LE connection to a connectable advertiser; for CONFIGBTCTLRSYNCISO, any broadcaster the device is synchronised to — can set the length byte up to 255 while the controller has programmed a much smaller maximum (lll->dle.eff.maxrxoctets, which is 27 until a Data Length Update, or the negotiated cislll->rx.maxpdu). No pairing, authentication or user interaction is required. On encrypted links the CCM MIC check normally rejects such a frame first, so the exposure is on unencrypted traffic, which is why the added check is placed after decryption.
The unchecked length reaches hciaclencode() in subsys/bluetooth/controller/hci/hci.c, which performs netbufadd(buf, pdudata->len) followed by a memcpy() of that many bytes out of the noderx pool element. Because CONFIGBTCTLRDATALENGTHMAX and CONFIGBTBUFACLRXSIZE both default to 27, this is an out-of-bounds read of up to roughly 228 bytes past the received PDU and a corresponding out-of-bounds write past the HCI ACL buffer into neighbouring buffers of the same pool; the tailroom test in netbufsimpleadd() is only enforced when CONFIGNETBUFHARDENING (or CONFIGASSERT) is enabled. On the ISO paths the same unchecked length makes isoalrxappendtosdu() read past the ISO node buffer and emit adjacent controller RAM to the host as ISO data. The practical result is remote memory corruption and controller crashes, plus disclosure of controller memory into the host data path.
The fix rejects any received PDU whose length exceeds the value that was used to configure the radio reception. Note that lllsync.c (periodic advertising sync reception) was not changed and still enqueues received PDUs without an equivalent bound.
Event History
Frequently Asked Questions
What does an attacker need to reach a vulnerable receive path?
The attacker must be within Bluetooth radio range and able to transmit a crafted link-layer PDU. For the described connection attack path, the attacker must establish an unencrypted LE connection to a connectable advertiser; for CONFIG_BT_CTLR_SYNC_ISO, the device must be synchronized to the attacker's broadcaster.
Does link-layer encryption prevent the described attack?
Encrypted links perform a MIC check before the PDU is enqueued. The explicitly described connection attack vector is an unencrypted LE connection, so encryption changes the attacker prerequisites but the data does not establish that encryption alone eliminates all affected receive paths.
When is the mismatch between the declared and received payload length most likely to occur?
The controller can be programmed with a receive maximum much smaller than the PDU length field, which an attacker can set as high as 255. The effective maximum receive octets is 27 until a Data Length Update occurs, making that pre-update state a relevant condition.
Which Bluetooth features are identified as having affected receive handlers?
The data identifies connection receive handling, ISO receive handlers for central, peripheral, and synchronized ISO operation, and auxiliary scanning for extended advertising. Synchronized ISO exposure specifically depends on CONFIG_BT_CTLR_SYNC_ISO and synchronization to a broadcaster.