[GIT PULL] bluetooth 2026-09-15

The following changes since commit 83a945a529d6e002dd7339c532288a931f463dba:

  tcp: do not let tcp_rmem be set below 4096 (2026-09-15 15:21:17 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-09-15

for you to fetch changes up to 801fb950cae7048eb7d83b18857d1ca37b8cd5a4:

  Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (2026-09-15 14:55:41 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

Core:

 - hci: put the peer's on-air address on air when we cannot resolve
 - hci: keep dst_type with dst when reusing an LE connection
 - hci_core: Fix queuing tx_work after workqueue is drained
 - hci_sync: Serialize local codec list cleanup
 - hci_codec: validate vendor codec count length
 - eir: validate service data length before reading UUID
 - RFCOMM: avoid socket lock inversion in listener cleanup
 - ISO: Fix parent socket leak in iso_conn_ready()
 - ISO: set BT_LISTEN before requesting a BIG sync
 - coredump: Quiesce dump work on unregister

Drivers:

 - btintel_pcie: validate TX skb length in send_sync
 - btmtk: fix wrong status for short WMT FUNC_CTRL events
 - btmtksdio, btmtkuart: validate WMT event length before struct access
 - hci_qca: Do not write to the serial port after it is closed
 - btusb: fix NXP IW610 composite device handling
 - btintel_pcie: fix off-by-one bounds check in RX submit
 - btmtksdio: Fix PM runtime reference leak in shutdown

----------------------------------------------------------------
Aamir Ahmed (1):
      Bluetooth: eir: validate service data length before reading UUID

Chandrashekar Devegowda (1):
      Bluetooth: btintel_pcie: validate TX skb length in send_sync

Chengfeng Ye (1):
      Bluetooth: hci_sync: Serialize local codec list cleanup

Chris Lu (2):
      Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
      Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

Ibrahim Abdelkader (1):
      Bluetooth: hci_qca: Do not write to the serial port after it is closed

Juan Perdomo (1):
      Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

Laxman Acharya Padhya (1):
      Bluetooth: hci_codec: validate vendor codec count length

Luiz Augusto von Dentz (2):
      Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
      Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync

Nicolas Thibert (1):
      Bluetooth: btusb: fix NXP IW610 composite device handling

Radek Podgorny (2):
      Bluetooth: put the peer's on-air address on air when we cannot resolve
      Bluetooth: keep dst_type with dst when reusing an LE connection

Sai Teja Aluvala (1):
      Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit

ThangNN99 (1):
      Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

Tzung-Bi Shih (1):
      Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown

Weiming Shi (1):
      Bluetooth: coredump: Quiesce dump work on unregister

 drivers/bluetooth/btintel_pcie.c |  8 ++++-
 drivers/bluetooth/btmtk.c        |  7 ++++-
 drivers/bluetooth/btmtksdio.c    | 24 ++++++++++++---
 drivers/bluetooth/btmtkuart.c    | 20 ++++++++++++-
 drivers/bluetooth/btusb.c        | 17 +++++++++++
 drivers/bluetooth/hci_qca.c      | 14 ++++++---
 include/net/bluetooth/coredump.h |  2 ++
 net/bluetooth/coredump.c         | 65 +++++++++++++++++++++++++++-------------
 net/bluetooth/eir.c              | 10 ++++++-
 net/bluetooth/hci_codec.c        | 36 +++++++++++-----------
 net/bluetooth/hci_conn.c         | 21 +++++++++++++
 net/bluetooth/hci_core.c         | 18 +++++++++--
 net/bluetooth/hci_sync.c         |  2 ++
 net/bluetooth/iso.c              | 53 +++++++++++++++++++++++++-------
 net/bluetooth/rfcomm/sock.c      | 13 ++++++--
 15 files changed, 242 insertions(+), 68 deletions(-)