[GIT PULL] bluetooth 2026-06-10

[GIT PULL] bluetooth 2026-06-10

[Luiz Augusto von Dentz]

The following changes since commit 149324fc762c2a7acef9c26790566f81f475e51f:

  Bluetooth: MGMT: Fix backward compatibility with userspace (2026-06-03 11:24:12 -0400)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-06-10

for you to fetch changes up to f98220e190507d3eb3e02f9a2f20c418c30d04ae:

  Bluetooth: vhci: validate devcoredump state before side effects (2026-06-10 13:51:15 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

 - hci_core: Fix UAF in hci_unregister_dev()
 - hci_event: fix simultaneous discovery stuck in FINDING
 - hci: validate codec capability element length
 - eir: Fix stack OOB write when prepending the Flags AD
 - L2CAP: Fix UAF in channel timeout by holding conn ref
 - btusb: fix use-after-free on registration failure
 - btusb: fix use-after-free on marvell probe failure
 - btusb: fix wakeup source leak on probe failure
 - btusb: fix wakeup irq devres lifetime
 - btmtk: fix URB leak in alloc_mtk_intr_urb error path
 - vhci: validate devcoredump state before side effects

----------------------------------------------------------------
Jiajia Liu (1):
      Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING

Johan Hovold (4):
      Bluetooth: btusb: fix use-after-free on registration failure
      Bluetooth: btusb: fix use-after-free on marvell probe failure
      Bluetooth: btusb: fix wakeup source leak on probe failure
      Bluetooth: btusb: fix wakeup irq devres lifetime

Jordan Walters (1):
      Bluetooth: hci_core: Fix UAF in hci_unregister_dev()

Marco Elver (1):
      Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

Samuel Moelius (2):
      Bluetooth: hci: validate codec capability element length
      Bluetooth: vhci: validate devcoredump state before side effects

Weiming Shi (1):
      Bluetooth: eir: Fix stack OOB write when prepending the Flags AD

Zhao Dongdong (1):
      Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path

 drivers/bluetooth/btmtk.c     |  4 +++-
 drivers/bluetooth/btusb.c     | 55 ++++++++++++++++++++++++++++++++++---------
 drivers/bluetooth/hci_vhci.c  | 10 ++++++++
 include/net/bluetooth/l2cap.h |  1 +
 net/bluetooth/eir.c           |  8 ++++---
 net/bluetooth/hci_codec.c     |  2 +-
 net/bluetooth/hci_core.c      |  2 ++
 net/bluetooth/hci_event.c     |  7 ++++++
 net/bluetooth/l2cap_core.c    | 34 +++++++++++++++-----------
 9 files changed, 93 insertions(+), 30 deletions(-)

Re: [GIT PULL] bluetooth 2026-06-10

[Jakub Kicinski]

On Wed, 10 Jun 2026 14:00:50 -0400 Luiz Augusto von Dentz wrote:
> bluetooth pull request for net:
> 
>  - hci_core: Fix UAF in hci_unregister_dev()
>  - hci_event: fix simultaneous discovery stuck in FINDING
>  - hci: validate codec capability element length
>  - eir: Fix stack OOB write when prepending the Flags AD
>  - L2CAP: Fix UAF in channel timeout by holding conn ref
>  - btusb: fix use-after-free on registration failure
>  - btusb: fix use-after-free on marvell probe failure
>  - btusb: fix wakeup source leak on probe failure
>  - btusb: fix wakeup irq devres lifetime
>  - btmtk: fix URB leak in alloc_mtk_intr_urb error path
>  - vhci: validate devcoredump state before side effects

Missed the PR :( Sorry about that :(
*iif* you're still rebasing the tree - could you mend the fixes tag?

Commit: 13d7c52acbb8 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
	Fixes tag: Fixes: 75780ca4c6a8 ("Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()")
	Has these problem(s):
		- Target SHA1 does not exist