From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: davem@davemloft.net, kuba@kernel.org
Cc: linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org
Subject: [GIT PULL] bluetooth 2026-07-06
Date: Mon, 6 Jul 2026 10:52:29 -0400 [thread overview]
Message-ID: <20260706145229.728127-1-luiz.dentz@gmail.com> (raw)
The following changes since commit 9e05e91a9a847ed57926414bd7c2c5e54d6c56c6:
amt: fix size calculation in amt_get_size() (2026-07-06 13:01:24 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-07-06
for you to fetch changes up to 6e1930ece855a4c256f1c7e6632d634cfb9888b5:
Bluetooth: L2CAP: fix tx ident leak for commands without a response (2026-07-06 10:46:58 -0400)
----------------------------------------------------------------
bluetooth pull request for net:
- hci_conn: Fix null ptr deref in hci_abort_conn()
- af_bluetooth: fix UAF in bt_accept_dequeue()
- L2CAP: validate option length before reading conf opt value
- L2CAP: cancel pending_rx_work before taking conn->lock
- L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
- L2CAP: fix tx ident leak for commands without a response
- SCO: Fix a race condition in sco_sock_timeout()
- ISO: avoid NULL deref of conn in iso_conn_big_sync()
- ISO: fix malformed ISO_END/CONT handling
- ISO: exclude RFU bits from ISO_SDU_Length
- MGMT: Fix adv monitor add failure cleanup
- MGMT: Fix UAF of hci_conn_params in add_device_complete
- bnep: pin L2CAP connection during netdev registration
- 6lowpan: avoid untracked enable work
- 6lowpan: hold L2CAP conn across debugfs control
- 6lowpan: Fix using chan->conn as indication to no remote netdev
- btintel_pcie: Refactor FLR to use device_reprobe()
- btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
- hci_uart: clear HCI_UART_SENDING when write_work is canceled
- bpa10x: avoid OOB read of revision string in bpa10x_setup()
----------------------------------------------------------------
Cen Zhang (3):
Bluetooth: 6lowpan: avoid untracked enable work
Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
Bluetooth: MGMT: Fix adv monitor add failure cleanup
Kiran K (1):
Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()
Luiz Augusto von Dentz (1):
Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
Maoyi Xie (1):
Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
Muhammad Bilal (2):
Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
Bluetooth: L2CAP: validate option length before reading conf opt value
Pauli Virtanen (3):
Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
Bluetooth: ISO: fix malformed ISO_END/CONT handling
Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
Runyu Xiao (1):
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
Samuel Page (1):
Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
Siwei Zhang (2):
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
Stig Hornang (1):
Bluetooth: L2CAP: fix tx ident leak for commands without a response
Sungwoo Kim (1):
Bluetooth: sco: Fix a race condition in sco_sock_timeout()
Weiming Shi (1):
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
Yousef Alhouseen (2):
Bluetooth: bnep: pin L2CAP connection during netdev registration
Bluetooth: fix UAF in bt_accept_dequeue()
drivers/bluetooth/bpa10x.c | 8 ++-
drivers/bluetooth/btintel_pcie.c | 102 ++++++++++++++--------------
drivers/bluetooth/btnxpuart.c | 6 ++
drivers/bluetooth/hci_ldisc.c | 14 ++--
include/net/bluetooth/hci.h | 5 +-
include/net/bluetooth/hci_core.h | 1 +
include/net/bluetooth/l2cap.h | 10 +--
net/bluetooth/6lowpan.c | 84 +++++++----------------
net/bluetooth/af_bluetooth.c | 17 +----
net/bluetooth/bnep/core.c | 27 ++++++--
net/bluetooth/hci_conn.c | 21 +-----
net/bluetooth/hci_sync.c | 133 +++++++++++++++++++++++++++++++++----
net/bluetooth/iso.c | 44 +++++++-----
net/bluetooth/l2cap_core.c | 140 ++++++++++++++++++++++++++++++---------
net/bluetooth/l2cap_sock.c | 107 ++++++++++++++----------------
net/bluetooth/mgmt.c | 5 ++
net/bluetooth/msft.c | 2 +-
net/bluetooth/sco.c | 15 ++++-
net/bluetooth/smp.c | 27 ++------
19 files changed, 467 insertions(+), 301 deletions(-)
reply other threads:[~2026-07-06 14:52 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260706145229.728127-1-luiz.dentz@gmail.com \
--to=luiz.dentz@gmail.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox