[GIT PULL] bluetooth 2026-08-31

The following changes since commit 1376afc7660bad2a1a5ee0876898312a486cf8bd:

  octeontx2-af: fix CN20K default MCAM rule removal on port cleanup (2026-08-31 10:04:32 +0100)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-08-31

for you to fetch changes up to 2deb76c21b81e42b3282224f7dd2046fe73fd1e0:

  Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (2026-08-31 14:05:27 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

Core:

 - hci_core: Fix race condition during device registration
 - L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
 - L2CAP: fix out-of-bounds write in l2cap_ecred_connect
 - L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM

Drivers:

 - hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
 - btintel_pcie: Clear automask on spurious interrupts
 - btintel: validate version TLV value lengths
 - btintel: bound firmware ID by TLV length
 - btintel: propagate version TLV parsing errors

----------------------------------------------------------------
Aleksandr Nogikh (1):
      Bluetooth: hci_core: Fix race condition during device registration

Gongwei Li (1):
      Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()

Kiran K (1):
      Bluetooth: btintel_pcie: Clear automask on spurious interrupts

Laxman Acharya Padhya (3):
      Bluetooth: btintel: validate version TLV value lengths
      Bluetooth: btintel: bound firmware ID by TLV length
      Bluetooth: btintel: propagate version TLV parsing errors

Pauli Virtanen (3):
      Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
      Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
      Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM

 drivers/bluetooth/btintel.c      | 44 ++++++++++++++++++++++++++++++++++++----
 drivers/bluetooth/btintel_pcie.c |  3 +++
 drivers/bluetooth/hci_mrvl.c     |  3 +--
 net/bluetooth/hci_core.c         |  4 ++--
 net/bluetooth/l2cap_core.c       | 33 +++++++++++++++++++++++-------
 net/bluetooth/msft.c             |  2 +-
 6 files changed, 73 insertions(+), 16 deletions(-)