[GIT PULL] bluetooth 2026-07-28

[GIT PULL] bluetooth 2026-07-28

[Luiz Augusto von Dentz]

The following changes since commit e095f249e2209674f6366f6db0383a2b96e19239:

  net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (2026-07-28 15:53:49 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-07-28

for you to fetch changes up to abd93c85c8667add738ee82aeab95dd9fc8265a2:

  Bluetooth: SCO: give the socket its own sco_conn reference (2026-07-28 16:13:48 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

 - hci_sync: Fix advertising data UAFs
 - hci_conn: hold conn reference fixes
 - L2CAP: fix UAF in l2cap_le_connect_rsp
 - RFCOMM: validate skb length in rfcomm_recv_frame
 - ISO: Locking fixes
 - SCO: give the socket its own sco_conn reference
 - MGMT: fix UAF in pair command cancellation
 - MGMT: fix pending command UAF in EIR updates
 - HIDP: reject frames without a transaction header
 - HIDP: validate numbered report payloads
 - btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
 - btmtk: Fix short read errors in btmtk_usb_reg_read()
 - btusb: Fix short read errors in btusb_qca_send_vendor_req()
 - btintel: Validate length before parsing diagnostics TLV

----------------------------------------------------------------
Aldo Ariel Panzardo (1):
      Bluetooth: SCO: give the socket its own sco_conn reference

Chengfeng Ye (1):
      Bluetooth: hci_sync: Fix advertising data UAFs

Greg Kroah-Hartman (3):
      Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
      Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
      Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()

Jiale Yao (2):
      Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
      Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame

Pauli Virtanen (19):
      Bluetooth: ISO: clear iso_data always when detaching conn from hcon
      Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
      Bluetooth: ISO: lock sk in iso_sock_getname
      Bluetooth: ISO: lock sk in iso_connect_ind
      Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
      Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
      Bluetooth: ISO: hold sk properly in iso_conn_ready
      Bluetooth: ISO: fix leaking sk after socket release
      Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
      Bluetooth: ISO: ensure no dangling hcon references in iso_conn
      Bluetooth: ISO: fix refcounting of iso_conn
      Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
      Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
      Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
      Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
      Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
      Bluetooth: hci_sync: hold conn in hci_past_sync() callback
      Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
      Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync

Sangho Lee (2):
      Bluetooth: HIDP: reject frames without a transaction header
      Bluetooth: HIDP: validate numbered report payloads

Zihan Xi (2):
      Bluetooth: mgmt: fix UAF in pair command cancellation
      Bluetooth: mgmt: fix pending command UAF in EIR updates

Zijun Hu (1):
      Bluetooth: btintel: Validate length before parsing diagnostics TLV

 drivers/bluetooth/btintel.c      |   3 +
 drivers/bluetooth/btmtk.c        |  86 ++++++------
 drivers/bluetooth/btusb.c        |  30 ++---
 include/net/bluetooth/hci_core.h |   4 +-
 net/bluetooth/hci_conn.c         |  14 +-
 net/bluetooth/hci_sync.c         | 216 +++++++++++++++++++++----------
 net/bluetooth/hidp/core.c        |  30 +++--
 net/bluetooth/iso.c              | 273 +++++++++++++++++++++++++++------------
 net/bluetooth/l2cap_core.c       |   5 +
 net/bluetooth/mgmt.c             |  84 +++++++++---
 net/bluetooth/rfcomm/core.c      |   5 +
 net/bluetooth/sco.c              |  22 ++--
 12 files changed, 513 insertions(+), 259 deletions(-)