kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity

bluetooth pull request for net:

Browse source 
Core:
 
  - hci_conn: fix CIS hold ownership on reuse
  - hci_sock: reject out-of-range OCF values
  - hci_sock: validate event length before filtering
  - L2CAP: validate frame length before control and FCS access
  - RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
  - RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
  - ISO: release unused CIS holds after channel attach
  - ISO: balance the parent hold in hci_bind_bis()
  - SMP: reject Security Request over BR/EDR
  - MGMT: fix race in read_unconf_index_list()
  - MGMT: Dequeue pending mesh_send_sync entries on cancel
  - BNEP: fix out-of-bounds reads on short RX/TX frames and control fallthrough
 
 Drivers:
 
  - btintel_pcie: validate device-supplied DMA indices
  - btnxpuart: Fix skb leak in nxp_process_fw_dump()
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmqxN44ZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKS7mD/43nt9IlCMp4fRi5eT3iV6J
 phP/zJTiikgOMv87kTI0Q9OXY8Xl1nhIGrTiypXQIJNJGTW/OTHtMF+N55pA7pF4
 exD0US01bKUcuopztHeP1Yk08CMKAtE9VTPLi/PdAQz6KTo7wcH7yFwfsO6avIk4
 T/IXi9b8iKPBMKizjgUe8Uo6wrFoByD/o2VwTSQwtZOgWppUkCvVKKx10Y8EYJRG
 UbDS8rpPtWN3t0fK5F4yVfkTP+9sA7uWb9bF2UoLcmov2ie33M50zf5giVofiNrX
 pT6RWTCPfjkPdDro66l6wV4M8prEUVok0QhlqeYOUXSZJSOTqqXBTOorioABSeHz
 i4QWH+KsqUFbaOJQuoF3v5jAccY8ZxKczRODK8Xt1+bY9O73lqpuWjQvoi98E/7i
 vNCSU/bDpRS0MjYDTgQTG9c0rv9qxKI0GBC8gDVI78/nAzUIxdJ09/wDBm17aUpt
 uxaBwYE1lhJwT0Lf+dwJrwVuTm5q5XotdRIsOwxZgfF25Ewk8ygUlEsQu/ioHmS+
 q+9SL/mHb/wPI7j0YeVG2l7cHiHOZDEn0FW++WlgtF1Oj/HWUsz2UN/qdmpYZo1h
 rGX7D2DdZQo8IOEmZZn7wqLNOxjPjFVkxgQtgWd5OhE0O+7/e2H4mNeDJyWs6rJp
 lT1BJZnPQTFtwP41x7Hxng==
 =cLTc
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2026-09-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

Core:

 - hci_conn: fix CIS hold ownership on reuse
 - hci_sock: reject out-of-range OCF values
 - hci_sock: validate event length before filtering
 - L2CAP: validate frame length before control and FCS access
 - RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
 - RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
 - ISO: release unused CIS holds after channel attach
 - ISO: balance the parent hold in hci_bind_bis()
 - SMP: reject Security Request over BR/EDR
 - MGMT: fix race in read_unconf_index_list()
 - MGMT: Dequeue pending mesh_send_sync entries on cancel
 - BNEP: fix out-of-bounds reads on short RX/TX frames and control fallthrough

Drivers:

 - btintel_pcie: validate device-supplied DMA indices
 - btnxpuart: Fix skb leak in nxp_process_fw_dump()

* tag 'for-net-2026-09-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
  Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
  Bluetooth: btintel_pcie: validate device-supplied DMA indices
  Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
  Bluetooth: mgmt: fix race in read_unconf_index_list()
  Bluetooth: L2CAP: validate frame length before control and FCS access
  Bluetooth: ISO: balance the parent hold in hci_bind_bis()
  Bluetooth: hci_sock: validate event length before filtering
  Bluetooth: hci_sock: reject out-of-range OCF values
  Bluetooth: ISO: release unused CIS holds after channel attach
  Bluetooth: hci_conn: fix CIS hold ownership on reuse
  Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
  Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
  Bluetooth: SMP: reject Security Request over BR/EDR
====================

Link: https://patch.msgid.link/20260921135807.3459373-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-09-21 18:20:07 -07:00
commit f0b88fade6
12 changed files with 128 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files