From: Jakub Kicinski Date: Wed, 29 Jul 2026 00:30:21 +0000 (-0700) Subject: Merge tag 'for-net-2026-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/bluet... X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0408e7f6f6a1af236ca32e668f5f3f5833bec5af;p=thirdparty%2Fkernel%2Fstable.git Merge tag 'for-net-2026-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: Fix advertising data UAFs - hci_conn: hold conn reference fixes - L2CAP: fix UAF in l2cap_le_connect_rsp - RFCOMM: validate skb length in rfcomm_recv_frame - ISO: Locking fixes - SCO: give the socket its own sco_conn reference - MGMT: fix UAF in pair command cancellation - MGMT: fix pending command UAF in EIR updates - HIDP: reject frames without a transaction header - HIDP: validate numbered report payloads - btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() - btmtk: Fix short read errors in btmtk_usb_reg_read() - btusb: Fix short read errors in btusb_qca_send_vendor_req() - btintel: Validate length before parsing diagnostics TLV * tag 'for-net-2026-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: (31 commits) Bluetooth: SCO: give the socket its own sco_conn reference Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync Bluetooth: hci_sync: hold conn in hci_past_sync() callback Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks Bluetooth: hci_conn: hold conn reference in abort_conn_sync() Bluetooth: btintel: Validate length before parsing diagnostics TLV Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero Bluetooth: ISO: fix refcounting of iso_conn Bluetooth: ISO: ensure no dangling hcon references in iso_conn Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Bluetooth: ISO: fix leaking sk after socket release Bluetooth: ISO: hold sk properly in iso_conn_ready Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos ... ==================== Link: https://patch.msgid.link/20260728201527.2456032-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski --- 0408e7f6f6a1af236ca32e668f5f3f5833bec5af