Hi all,

The following commit is also in Linus Torvalds' tree as a different commit
(but the same patch):

  088ef4eaad98a ("Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev")
  0aab041d532fc ("Bluetooth: btrtl: Don't leak return code when parsing firmware format v2")
  0c9d2588a514f ("Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728")
  13e96569bf6a4 ("Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()")
  14a97a38ba8f2 ("Bluetooth: eir: Fix OOB read in eir_get_service_data()")
  1c08039e3887f ("Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop")
  1fcf216462ec3 ("Bluetooth: btnxpuart: Validate the FW dump header length")
  262cb784c96cb ("Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path")
  26cf20d065b31 ("Bluetooth: hci_sync: add conditional locking annotations")
  32b42c0704fdd ("Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative")
  40c621391de93 ("Bluetooth: RFCOMM: serialize security confirmation handling")
  486f8908aa587 ("Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready")
  512bf44847667 ("Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform")
  54c03e6bc7188 ("Bluetooth: btmtk: Do not discard the subsystem reset timeout")
  58c6f5ec1d22b ("Bluetooth: btintel: bound firmware ID by TLV length")
  762385e862009 ("Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378")
  771e812f94b32 ("Bluetooth: btmtk: Do not report success when subsys reset fails")
  78f08df9649c1 ("Bluetooth: hci_core: Fix race condition during device registration")
  83a1797b2020f ("Bluetooth: btusb: Fix UAF of btusb_data by rx_work")
  870187be23621 ("Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()")
  88a8184cb44c8 ("Bluetooth: hci_sync: Fix not setting CE length properly")
  951d9f743029b ("Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX")
  99672791e9c9f ("Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference")
  9db7e5fffbaec ("Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN")
  9e257e3586428 ("Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative")
  a8bfcece8b49a ("Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one")
  aadb3cd4bbb47 ("Bluetooth: do not leak an hci_conn when a second LE connect is rejected")
  af04b0e3176e5 ("Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM")
  b1f1766ef7691 ("Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan")
  b361e99dd3fbd ("Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware")
  b8d936018ce2b ("Bluetooth: hci_uart: Fix false success return in hci_uart_setup()")
  bc2791e60e082 ("Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative")
  bcb621272aa04 ("Bluetooth: btintel_pcie: Clear automask on spurious interrupts")
  be766d775060e ("Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb")
  d1b752f552896 ("Bluetooth: L2CAP: access chan->conn safely in get/setsockopt")
  d2d1c215ce117 ("Bluetooth: hci_conn: re-enable advertising only for peripheral role")
  d67f4a43e7ef8 ("Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan")
  ddaccd985bb01 ("Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect")
  de8d29ede6f32 ("Bluetooth: btintel_pcie: validate packet_len before skb_put_data")
  e4d6d16f1be19 ("Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection")
  eacbfff162377 ("Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset")
  eb656c5bb7543 ("Bluetooth: btintel: validate version TLV value lengths")
  ed516e3f1aa61 ("Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request")
  f716a05f49671 ("Bluetooth: btnxpuart: Check remote M.2 connector availability before pwrseq")
  f8c8fa407aa0f ("Bluetooth: btintel: propagate version TLV parsing errors")
  fe3897b4ab57b ("Bluetooth: RFCOMM: serialize session teardown")