CVE-2026-87040 | Zephyr Project up to 4.3.1/4.4.x Link Layer Receive Path lll_conn.c isr_rx_pdu len memory corruption

November 4, 2026 Yanac

A vulnerability was found in Zephyr Project Zephyr up to 4.3.1/4.4.x. It has been classified as very critical. This impacts the function isr_rx_pdu of the file subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c of the component Link Layer Receive Path. The manipulation of the argument len leads to memory corruption.

This vulnerability is uniquely identified as CVE-2026-87040. The attack is possible to be carried out remotely. No exploit exists.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More