[GIT PULL] bluetooth 2026-07-06

[GIT PULL] bluetooth 2026-07-06

[Luiz Augusto von Dentz]

The following changes since commit 9e05e91a9a847ed57926414bd7c2c5e54d6c56c6:

  amt: fix size calculation in amt_get_size() (2026-07-06 13:01:24 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-07-06

for you to fetch changes up to 6e1930ece855a4c256f1c7e6632d634cfb9888b5:

  Bluetooth: L2CAP: fix tx ident leak for commands without a response (2026-07-06 10:46:58 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

 - hci_conn: Fix null ptr deref in hci_abort_conn()
 - af_bluetooth: fix UAF in bt_accept_dequeue()
 - L2CAP: validate option length before reading conf opt value
 - L2CAP: cancel pending_rx_work before taking conn->lock
 - L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
 - L2CAP: fix tx ident leak for commands without a response
 - SCO: Fix a race condition in sco_sock_timeout()
 - ISO: avoid NULL deref of conn in iso_conn_big_sync()
 - ISO: fix malformed ISO_END/CONT handling
 - ISO: exclude RFU bits from ISO_SDU_Length
 - MGMT: Fix adv monitor add failure cleanup
 - MGMT: Fix UAF of hci_conn_params in add_device_complete
 - bnep: pin L2CAP connection during netdev registration
 - 6lowpan: avoid untracked enable work
 - 6lowpan: hold L2CAP conn across debugfs control
 - 6lowpan: Fix using chan->conn as indication to no remote netdev
 - btintel_pcie: Refactor FLR to use device_reprobe()
 - btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
 - hci_uart: clear HCI_UART_SENDING when write_work is canceled
 - bpa10x: avoid OOB read of revision string in bpa10x_setup()

----------------------------------------------------------------
Cen Zhang (3):
      Bluetooth: 6lowpan: avoid untracked enable work
      Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
      Bluetooth: MGMT: Fix adv monitor add failure cleanup

Kiran K (1):
      Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()

Luiz Augusto von Dentz (1):
      Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev

Maoyi Xie (1):
      Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()

Muhammad Bilal (2):
      Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
      Bluetooth: L2CAP: validate option length before reading conf opt value

Pauli Virtanen (3):
      Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
      Bluetooth: ISO: fix malformed ISO_END/CONT handling
      Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length

Runyu Xiao (1):
      Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock

Samuel Page (1):
      Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

Siwei Zhang (2):
      Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
      Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

Stig Hornang (1):
      Bluetooth: L2CAP: fix tx ident leak for commands without a response

Sungwoo Kim (1):
      Bluetooth: sco: Fix a race condition in sco_sock_timeout()

Weiming Shi (1):
      Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

Yousef Alhouseen (2):
      Bluetooth: bnep: pin L2CAP connection during netdev registration
      Bluetooth: fix UAF in bt_accept_dequeue()

 drivers/bluetooth/bpa10x.c       |   8 ++-
 drivers/bluetooth/btintel_pcie.c | 102 ++++++++++++++--------------
 drivers/bluetooth/btnxpuart.c    |   6 ++
 drivers/bluetooth/hci_ldisc.c    |  14 ++--
 include/net/bluetooth/hci.h      |   5 +-
 include/net/bluetooth/hci_core.h |   1 +
 include/net/bluetooth/l2cap.h    |  10 +--
 net/bluetooth/6lowpan.c          |  84 +++++++----------------
 net/bluetooth/af_bluetooth.c     |  17 +----
 net/bluetooth/bnep/core.c        |  27 ++++++--
 net/bluetooth/hci_conn.c         |  21 +-----
 net/bluetooth/hci_sync.c         | 133 +++++++++++++++++++++++++++++++++----
 net/bluetooth/iso.c              |  44 +++++++-----
 net/bluetooth/l2cap_core.c       | 140 ++++++++++++++++++++++++++++++---------
 net/bluetooth/l2cap_sock.c       | 107 ++++++++++++++----------------
 net/bluetooth/mgmt.c             |   5 ++
 net/bluetooth/msft.c             |   2 +-
 net/bluetooth/sco.c              |  15 ++++-
 net/bluetooth/smp.c              |  27 ++------
 19 files changed, 467 insertions(+), 301 deletions(-)