Merge tag 'for-net-2026-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/bluet...

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - hci_sync: Fix advertising data UAFs
 - hci_conn: hold conn reference fixes
 - L2CAP: fix UAF in l2cap_le_connect_rsp
 - RFCOMM: validate skb length in rfcomm_recv_frame
 - ISO: Locking fixes
 - SCO: give the socket its own sco_conn reference
 - MGMT: fix UAF in pair command cancellation
 - MGMT: fix pending command UAF in EIR updates
 - HIDP: reject frames without a transaction header
 - HIDP: validate numbered report payloads
 - btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
 - btmtk: Fix short read errors in btmtk_usb_reg_read()
 - btusb: Fix short read errors in btusb_qca_send_vendor_req()
 - btintel: Validate length before parsing diagnostics TLV

* tag 'for-net-2026-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: (31 commits)
  Bluetooth: SCO: give the socket its own sco_conn reference
  Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
  Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read()
  Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
  Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync
  Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
  Bluetooth: hci_sync: hold conn in hci_past_sync() callback
  Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
  Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
  Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
  Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
  Bluetooth: btintel: Validate length before parsing diagnostics TLV
  Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
  Bluetooth: ISO: fix refcounting of iso_conn
  Bluetooth: ISO: ensure no dangling hcon references in iso_conn
  Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
  Bluetooth: ISO: fix leaking sk after socket release
  Bluetooth: ISO: hold sk properly in iso_conn_ready
  Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
  Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
  ...
====================

Link: https://patch.msgid.link/20260728201527.2456032-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>