Merge tag 'for-net-2026-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/bluet...

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - hci_conn: Fix null ptr deref in hci_abort_conn()
 - af_bluetooth: fix UAF in bt_accept_dequeue()
 - L2CAP: validate option length before reading conf opt value
 - L2CAP: cancel pending_rx_work before taking conn->lock
 - L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
 - L2CAP: fix tx ident leak for commands without a response
 - SCO: Fix a race condition in sco_sock_timeout()
 - ISO: avoid NULL deref of conn in iso_conn_big_sync()
 - ISO: fix malformed ISO_END/CONT handling
 - ISO: exclude RFU bits from ISO_SDU_Length
 - MGMT: Fix adv monitor add failure cleanup
 - MGMT: Fix UAF of hci_conn_params in add_device_complete
 - bnep: pin L2CAP connection during netdev registration
 - 6lowpan: avoid untracked enable work
 - 6lowpan: hold L2CAP conn across debugfs control
 - 6lowpan: Fix using chan->conn as indication to no remote netdev
 - btintel_pcie: Refactor FLR to use device_reprobe()
 - btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
 - hci_uart: clear HCI_UART_SENDING when write_work is canceled
 - bpa10x: avoid OOB read of revision string in bpa10x_setup()

* tag 'for-net-2026-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: L2CAP: fix tx ident leak for commands without a response
  Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
  Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
  Bluetooth: ISO: fix malformed ISO_END/CONT handling
  Bluetooth: btintel_pcie: Refactor FLR to use device_reprobe()
  Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
  Bluetooth: fix UAF in bt_accept_dequeue()
  Bluetooth: bnep: pin L2CAP connection during netdev registration
  Bluetooth: sco: Fix a race condition in sco_sock_timeout()
  Bluetooth: MGMT: Fix adv monitor add failure cleanup
  Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
  Bluetooth: 6lowpan: avoid untracked enable work
  Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
  Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
  Bluetooth: L2CAP: validate option length before reading conf opt value
  Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
  Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
  Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
  Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
  Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
====================

Link: https://patch.msgid.link/20260706145229.728127-1-luiz.dentz@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>