[syzbot] Monthly bluetooth report (Apr 2026)

[syzbot]

Hello bluetooth maintainers/developers,

This is a 31-day syzbot report for the bluetooth subsystem.
All related reports/information can be found at:
https://syzkaller.appspot.com/upstream/s/bluetooth

During the period, 1 new issues were detected and 1 were fixed.
In total, 32 issues are still open and 100 have already been fixed.

Some of the still happening issues:

Ref Crashes Repro Title
<1> 13597 Yes WARNING in hci_conn_timeout (2)
https://syzkaller.appspot.com/bug?extid=fc4b5b2477d4ca272907
<2> 8418 Yes WARNING in call_timer_fn
https://syzkaller.appspot.com/bug?extid=6fb78d577e89e69602f9
<3> 4468 Yes general protection fault in lock_sock_nested
https://syzkaller.appspot.com/bug?extid=d3ccfb78a0dc16ffebe3
<4> 1400 No KASAN: vmalloc-out-of-bounds Read in kcov_remote_start
https://syzkaller.appspot.com/bug?extid=8a173e13208949931dc7
<5> 1022 Yes KASAN: slab-use-after-free Write in hci_conn_drop (3)
https://syzkaller.appspot.com/bug?extid=3609b9b48e68e1fe47fd
<6> 569 Yes possible deadlock in l2cap_conn_del
https://syzkaller.appspot.com/bug?extid=b71bb48c13bf3fed3692
<7> 351 No WARNING in l2cap_chan_del
https://syzkaller.appspot.com/bug?extid=3272785b7a1fc9b510f6
<8> 273 Yes KASAN: wild-memory-access Read in l2cap_connect_cfm
https://syzkaller.appspot.com/bug?extid=0e4ebcc970728e056324
<9> 167 Yes WARNING in hci_recv_frame
https://syzkaller.appspot.com/bug?extid=3e07a461b836821ff70e
<10> 147 Yes KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb
https://syzkaller.appspot.com/bug?extid=cdae834448ec8c3602fe

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

To disable reminders for individual bugs, reply with the following command:
#syz set <Ref> no-reminders

To change bug's subsystems, reply with:
#syz set <Ref> subsystems: new-subsystem

You may send multiple commands in a single email message.