Merge tag 'for-net-2026-03-12' of git://git.kernel.org/pub/scm/linux/kernel/git/bluet...

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - hci_sync: Fix hci_le_create_conn_sync
 - MGMT: Fix list corruption and UAF in command complete handlers
 - L2CAP: Disconnect if received packet's SDU exceeds IMTU
 - L2CAP: Disconnect if sum of payload sizes exceed SDU
 - L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
 - L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
 - L2CAP: Validate L2CAP_INFO_RSP payload length before access
 - L2CAP: Fix use-after-free in l2cap_unregister_user
 - ISO: Fix defer tests being unstable
 - HIDP: Fix possible UAF
 - SMP: make SM/PER/KDU/BI-04-C happy
 - qca: fix ROM version reading on WCN3998 chips

* tag 'for-net-2026-03-12' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: qca: fix ROM version reading on WCN3998 chips
  Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
  Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
  Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
  Bluetooth: HIDP: Fix possible UAF
  Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
  Bluetooth: hci_sync: Fix hci_le_create_conn_sync
  Bluetooth: ISO: Fix defer tests being unstable
  Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
  Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
  Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
====================

Link: https://patch.msgid.link/20260312200655.1215688-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>