linux-bluetooth Weekly Report - Week 38
Total messages: 418 (271 human, 147 CI/bot)
linux-bluetooth Weekly Report - Week 33
16 August 2026
Total messages: 235 (145 human, 90 CI/bot)
Note: Of the 235 messages, 145 are human-generated, 90 are CI/bot (bluez.test.bot: 42, patchwork-bot+bluetooth: 21, BluezTestBot: 15, bugzilla-daemon: 7, kernel test robot: 3, syzbot: 1, Sasha Levin: 1).
Summary
During week 33 (10 - 16 August 2026) the linux-bluetooth mailing list carried 235 messages, 145 from contributors and 90 from CI and bots. There were 51 human-initiated threads: 34 kernel patch series, 12 BlueZ userspace series and 5 discussions or reports. 21 patches were applied via patchwork and 10 commits were pushed to bluez repositories. The most active contributor was Bastien Nocera (Red Hat) with 27 messages. 7 series went through more than one revision during the week.
Key Patch Series & Discussions
Kernel Patches
BlueZ Userspace Patches
Discussions & Bug Reports
| Topic | From | Notes |
|---|---|---|
| [BUG] Bluetooth: WCN6855 10ab:9309 stops reporting ISO TX completions during BAP… | Jonas Zunker | 4 messages |
| Please backport two btusb/btrtl commits for RTL8761BU to 7.1.y, 6.18.y, 6.12.y a… | Stefan Muraru | 2 messages |
| CVE Request: BlueZ AVRCP Out-of-Bounds Read (CWE-125) | Elman Shahbazov | 1 message |
| [BUG] Bluetooth: KASAN null-ptr-deref in klist_put during HCI connection sysfs t… | ZW Tang | 1 message |
| [BUG] Bluetooth: MT7922 active LE scan misses ADV_SCAN_IND seen during passive s… | nibbo | 1 message |
Series Revised This Week
Top Contributors (by message count)
| Contributor | Affiliation | Messages |
|---|---|---|
| Bastien Nocera | Red Hat | 27 |
| Luiz Augusto von Dentz | Intel | 11 |
| Pauli Virtanen | Independent | 10 |
| Naga Bhavani Akella | Qualcomm | 7 |
| hadess | Red Hat | 6 |
| Ali Ahmet Memis | Independent | 6 |
| Ismail Tarim | Independent | 6 |
| Daniel Golle | Independent | 5 |
| Laxman Acharya Padhya | Independent | 5 |
| Manivannan Sadhasivam | Independent | 5 |
Merged to master (BlueZ & bluetooth-next)
Applied to bluetooth-next (kernel, via patchwork notifications)
- Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
- Bluetooth: btmtksdio: fix deadlock in close and reset paths
- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is neg
- Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last requ
- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is n
- Bluetooth: virtio_bt: Fix use-after-free and memory leak in probe erro
- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is nega
- Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
- Bluetooth: btusb: Add Realtek RTL8821CE device 13d3:3558
- Bluetooth: mgmt: fix ‘hdev->discovery.uuids’ NULL dereference
- Bluetooth: hci_serdev: Fix use-after-free in hci_uart_unregister_devic
- Bluetooth: bnep: refactor deprecated strcpy
- Bluetooth: btmrvl: Slightly simplify btmrvl_process_event()
Applied to BlueZ (via patchwork notifications)
- client: Avoid scan prompt when discovery is already active
- tools/l2cap-tester: add tests changing BT_SECURITY after connecting
- emulator: btvirt: support debug for -s socket server
- adv_monitor: Fix buffer overflow caused by integer overflow
- attrib: Fix smatch “non-ANSI function declaration” warning
- avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing
- 3 SDP XML security fixes
Pushed to bluez repositories
- tools/l2cap-tester: add tests changing BT_SECURITY…
- unit: Add test for sdp_xml_parse_record()
- doc: Add org.bluez.CSDistance1 documentation
- adv_monitor: Fix buffer overflow caused by integer…
- monitor: clamp max_len in print_packet
- sdp-xml: Use a queue to collect sequence members
- sdp-xml: Fix leaking the parse stack on malformed …
- attrib: Fix smatch “non-ANSI function declaration”…
- avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderIt…
- media: fix wrong argument to lp_get_uid() in avrcp…
Company Focus Areas
Independent Contributors
- device_schedule_reprobe(): core helper and conversions
- Bluetooth: btintel: harden version TLV parsing
- [BUG] Bluetooth: WCN6855 10ab:9309 stops reporting ISO TX completions during BAP…
- Bluetooth: L2CAP: avoid maybe-return-locked in l2cap_get_chan_by_scid/dcid
Red Hat
- 3 SDP XML security fixes
- 3 SDP XML security fixes
- adv_monitor: Fix buffer overflow caused by integer overflow
- attrib: Fix smatch “non-ANSI function declaration” warning
UnionTech
- Bluetooth: btintel_pcie: Fix array bounds check bugs
- Bluetooth: btmtksdio: fix deadlock in close and reset paths
- Bluetooth: hci_serdev: Fix use-after-free in hci_uart_unregister_device()
- Bluetooth: virtio_bt: Fix use-after-free and memory leak in probe error paths
Intel
- Bluetooth: btintel_pcie: parse FW memory region addresses via mailbox TLV
- sdp-xml: Fix leaking the parse stack on malformed input
- sdp-xml: Use a queue to collect sequence members
