pull-request: ieee802154 for net 2026-09-03

Hello Dave, Jakub, Paolo.

An update from ieee802154 for your *net* tree:

Zhiling Zou fixed a NULL deref when coming from a TUN device.

Fan Wu fixed a UAF in the cc2520 driver.

Chenguang Zhao fixed up some out of date comments in 6lowpan.

David Carlier fixed a potential double free in the hwsim driver.

Ibrahim Hashimov reworked the queuing in the RX path to fix a UAF on beacon
and MAC frames.

regards
Stefan Schmidt

The following changes since commit 70f3995830d3f1e79faa14eb0605914f778feca9:

  bonding: alb: fix uninitialized transport header access in alb_determine_nd() (2026-09-01 16:59:21 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan.git tags/ieee802154-for-net-2026-09-03

for you to fetch changes up to 2f37fba846c9fdff5fc15b6d93656057ccd13031:

  mac802154: fix use-after-free of sdata via queued RX frames (2026-09-03 11:00:54 +0200)

----------------------------------------------------------------
Chenguang Zhao (1):
      net: 6lowpan: fix mismatched comments

David Carlier (1):
      ieee802154: hwsim: serialize pib updates to fix double-free

Fan Wu (1):
      ieee802154: cc2520: fix FIFOP work use-after-free

Ibrahim Hashimov (1):
      mac802154: fix use-after-free of sdata via queued RX frames

Zhiling Zou (1):
      ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink

 drivers/net/ieee802154/cc2520.c          |   5 +-
 drivers/net/ieee802154/mac802154_hwsim.c |  10 ++-
 include/net/cfg802154.h                  |   1 +
 net/6lowpan/nhc.h                        |   3 +-
 net/ieee802154/6lowpan/core.c            |   2 +-
 net/mac802154/ieee802154_i.h             |   8 +++
 net/mac802154/iface.c                    |   6 ++
 net/mac802154/main.c                     |   1 +
 net/mac802154/rx.c                       | 120 +++++++++++++++++++++++++------
 net/mac802154/scan.c                     |  10 +--
 10 files changed, 128 insertions(+), 38 deletions(-)