[GIT PULL] bluetooth 2026-03-19

The following changes since commit 7ab4a7c5d969642782b8a5b608da0dd02aa9f229:

  MPTCP: fix lock class name family in pm_nl_create_listen_socket (2026-03-19 09:37:48 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-03-19

for you to fetch changes up to 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3:

  Bluetooth: L2CAP: Fix regressions caused by reusing ident (2026-03-19 14:44:25 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

 - hci_ll: Fix firmware leak on error path
 - hci_sync: annotate data-races around hdev->req_status
 - L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
 - L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
 - L2CAP: Fix regressions caused by reusing ident
 - L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
 - MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
 - SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

----------------------------------------------------------------
Anas Iqbal (1):
      Bluetooth: hci_ll: Fix firmware leak on error path

Cen Zhang (1):
      Bluetooth: hci_sync: annotate data-races around hdev->req_status

Helen Koike (1):
      Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb

Hyunwoo Kim (2):
      Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
      Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

Luiz Augusto von Dentz (2):
      Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
      Bluetooth: L2CAP: Fix regressions caused by reusing ident

Minseo Park (1):
      Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req

 drivers/bluetooth/hci_ll.c    |  2 ++
 include/net/bluetooth/l2cap.h |  1 +
 net/bluetooth/hci_conn.c      |  2 +-
 net/bluetooth/hci_core.c      |  2 +-
 net/bluetooth/hci_sync.c      | 20 ++++++++++----------
 net/bluetooth/l2cap_core.c    | 40 ++++++++++++++++++++++++++++++++++------
 net/bluetooth/l2cap_sock.c    |  3 +++
 net/bluetooth/mgmt.c          |  2 +-
 net/bluetooth/sco.c           | 10 +++++++---
 9 files changed, 60 insertions(+), 22 deletions(-)