[PATCH 6.6.y 0/2] CVE-2026-63974, CVE-2026-98297: backport fix series

[Artem Dinaburg]

Hi,

Please consider this backport series for CVE-2026-63974, CVE-2026-98297 to
6.6.y.

Apply the patches in this order:
1. Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (fix)
2. Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (fix)

Patch 1 marks the workqueue as draining during device close and waits for
earlier RCU-protected producers before draining it.

Patch 2 makes ACL, SCO and ISO transmit scheduling check that drain flag
under RCU, preventing new tx_work from being queued during close. The code
changes in both patches are identical to upstream.

The complete fix is already present in 6.12.y, 6.18.y and 7.2.y.

Build-tested only as part of a cumulative 6.6.y series on x86_64
(allmodconfig, CONFIG_WERROR=y); no runtime testing.

An LLM assisted with preparing these backports.

Thanks,
Artem Dinaburg