[GIT PULL] bluetooth 2026-07-21

The following changes since commit e13caf1c26587434f0b768193100440939c0fb91:

  Merge tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-17 10:25:13 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git tags/for-net-2026-07-21

for you to fetch changes up to df541cd485ff80a5ddc579d99687bc7506df9851:

  Bluetooth: btusb: validate Realtek vendor event length (2026-07-20 17:41:28 -0400)

----------------------------------------------------------------
bluetooth pull request for net:

 - hci_sync: Protect UUID list traversal
 - RFCOMM: Fix session UAF in set_termios
 - btusb: validate Realtek vendor event length

----------------------------------------------------------------
Chengfeng Ye (2):
      Bluetooth: hci_sync: Protect UUID list traversal
      Bluetooth: RFCOMM: Fix session UAF in set_termios

Pengpeng Hou (1):
      Bluetooth: btusb: validate Realtek vendor event length

 drivers/bluetooth/btusb.c      |  4 +++-
 include/net/bluetooth/rfcomm.h |  3 +++
 net/bluetooth/hci_sync.c       | 13 +++++++++++--
 net/bluetooth/rfcomm/core.c    | 17 +++++++++++++++++
 net/bluetooth/rfcomm/tty.c     |  7 +++----
 5 files changed, 37 insertions(+), 7 deletions(-)