[GIT PULL] bluetooth 2026-09-21

The following changes since commit 801fb950cae7048eb7d83b18857d1ca37b8cd5a4:

  Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (2026-09-15 14:55:41 -0400)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-09-21

for you to fetch changes up to 6d91041bb38b97e2feb625123cc0529d7b83a0e1:

  Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (2026-09-21 09:37:20 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

Core:

 - hci_conn: fix CIS hold ownership on reuse
 - hci_sock: reject out-of-range OCF values
 - hci_sock: validate event length before filtering
 - L2CAP: validate frame length before control and FCS access
 - RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
 - RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
 - ISO: release unused CIS holds after channel attach
 - ISO: balance the parent hold in hci_bind_bis()
 - SMP: reject Security Request over BR/EDR
 - MGMT: fix race in read_unconf_index_list()
 - MGMT: Dequeue pending mesh_send_sync entries on cancel
 - BNEP: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Drivers:

 - btintel_pcie: validate device-supplied DMA indices
 - btnxpuart: Fix skb leak in nxp_process_fw_dump()

----------------------------------------------------------------
Aldo Ariel Panzardo (7):
      Bluetooth: hci_conn: fix CIS hold ownership on reuse
      Bluetooth: ISO: release unused CIS holds after channel attach
      Bluetooth: hci_sock: reject out-of-range OCF values
      Bluetooth: hci_sock: validate event length before filtering
      Bluetooth: ISO: balance the parent hold in hci_bind_bis()
      Bluetooth: L2CAP: validate frame length before control and FCS access
      Bluetooth: mgmt: fix race in read_unconf_index_list()

Christiano Amora (1):
      Bluetooth: SMP: reject Security Request over BR/EDR

Hui Peng (3):
      Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
      Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
      Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

Lee Jones (1):
      Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

Ravindra (1):
      Bluetooth: btintel_pcie: validate device-supplied DMA indices

Zijun Hu (1):
      Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

 drivers/bluetooth/btintel_pcie.c | 16 ++++++++++++++++
 drivers/bluetooth/btnxpuart.c    |  8 +++++---
 net/bluetooth/bnep/core.c        | 17 ++++++++++++++++-
 net/bluetooth/bnep/netdev.c      |  8 +++++++-
 net/bluetooth/hci_conn.c         | 14 ++++++++++++--
 net/bluetooth/hci_sock.c         | 20 ++++++++++++++++----
 net/bluetooth/iso.c              |  7 +++++++
 net/bluetooth/l2cap_core.c       | 10 +++++++++-
 net/bluetooth/mgmt.c             | 27 +++++++++++++++++----------
 net/bluetooth/rfcomm/core.c      |  3 ++-
 net/bluetooth/rfcomm/sock.c      |  6 ++++--
 net/bluetooth/smp.c              | 17 +++++++++++++++++
 12 files changed, 128 insertions(+), 25 deletions(-)