linux-bluetooth Weekly Report - Week 32

Total messages: 286 (164 human, 122 CI/bot)

Note: Of the 286 messages, 164 are human-generated, 122 are CI/bot (bluez.test.bot: 53, bugzilla-daemon: 28, patchwork-bot+bluetooth: 17, BluezTestBot: 11, kernel test robot: 4, Sasha Levin: 3, syzbot: 3, github-actions[bot]: 2, patchwork-bot+netdevbpf: 1).

Summary

During week 32 (3 - 9 August 2026) the linux-bluetooth mailing list carried 286 messages, 164 from contributors and 122 from CI and bots. There were 65 human-initiated threads: 46 kernel patch series, 15 BlueZ userspace series and 4 discussions or reports. 17 patches were applied via patchwork and 9 commits were pushed to bluez repositories. The most active contributor was Bastien Nocera (Red Hat) with 23 messages. 10 series went through more than one revision during the week.

Key Patch Series & Discussions

Kernel Patches

BlueZ Userspace Patches

Discussions & Bug Reports

Series Revised This Week

Top Contributors (by message count)

Merged to master (BlueZ & bluetooth-next)

Applied to bluetooth-next (kernel, via patchwork notifications)

• Bluetooth: hci_event: validate LE Set CIG Parameters response
• Bluetooth: hci_sync: Fix accept list UAF during suspend
• Bluetooth: btmrvl: fix event packet length validation
• Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_i
• Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
• Bluetooth: fix cmd_sync payload lifetimes on the cancel path
• Bluetooth: btnxpuart: Add M.2 Bluetooth device support using pwrseq
• Bluetooth: ISO: zero the sockaddr before returning it in getname
• Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync
• Bluetooth: MSFT: validate evt_prefix_len against the response length
• Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is n
• Bluetooth: hci_sync: Disable legacy instance’s ext adv before setup sn
• Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
• Bluetooth: hci_event: fix out-of-bounds read in LE PA report reassembl

Applied to BlueZ (via patchwork notifications)

• unit/test-rap: Add PTS tests for CS
• monitor: Decode Intel DDC LE extended features
• Add PCIe M.2 Key E connector support for NXP i.MX boards

Pushed to bluez repositories

• Add cover art support
• monitor: Decode Intel DDC LE extended features
• avrcp: Split off name parsing from parse_*_element()
• unit: Remove Android avrcp.c dead-code
• unit: Add test for sdp_xml_parse_record()
• emulator: btvirt: support debug for -s socket server
• shared/gatt-client: discover the CCC descriptor in…
• client: Avoid scan prompt when discovery is alread…
• tools/l2cap-tester: add tests changing BT_SECURITY…

Company Focus Areas

Independent Contributors

• Bluetooth: fix cmd_sync payload lifetimes on the cancel path
• Bluetooth: MGMT: fix use-after-free of struct mgmt_mesh_tx
• Add cover art support
• Bluetooth: MGMT: fix use-after-free of struct mgmt_mesh_tx

Qualcomm

• Bluetooth: qca: Allow capturing QCA debug logs in snoop logs
• Bluetooth: virtio: improve RX handling
• Bluetooth: hci_sync: Add NVMEM-backed BD address retrieval
• Bluetooth: qca: Set NVMEM BD address quirks when address is invalid

Red Hat

• avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing
• avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing
• avrcp: Split off name parsing from parse_*_element()
• unit: Add test for sdp_xml_parse_record()

Google

• Bluetooth: SCO: Fix UAF on sco_sock_timeout
• Bluetooth: SCO: Fix UAF on sco_sock_timeout

UnionTech

• Bluetooth: btmtksdio: fix deadlock in close and reset paths
• Bluetooth: hci_serdev: Fix use-after-free in hci_uart_unregister_device()

Collabora

• Bluetooth: MGMT: Add management security level changed event

Intel

• [GIT PULL] bluetooth-next 2026-08-07

Samsung

• Bluetooth: btmrvl: fix event packet length validation