CVE-2026-74511: Bluetooth: mgmt: fix pending command UAF in EIR updates

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: mgmt: fix pending command UAF in EIR updates

MGMTOPSETLOCALNAME is handled asynchronously on powered controllers and can run setnamesync(). When the controller is BR/EDR capable, setnamesync() updates the local name and then rebuilds EIR data through eircreate(). The EIR builder walks hdev->uuids, but the UUID list can be changed and entries can be freed by MGMTOPADDUUID and MGMTOPREMOVEUUID.

pendingeirorclass() is meant to serialize management commands that can change EIR or the class of device, but it did not include MGMTOPSETLOCALNAME. In addition, it walked hdev->mgmtpending without hdev->mgmtpendinglock even though pending commands are added and removed under that mutex. A racing command completion can therefore remove and free a pending command while pendingeirorclass() is still inspecting it, leading to a use-after-free in the pending-command list or allowing a local name update to rebuild EIR while UUID entries are being removed.

Take hdev->mgmtpendinglock while scanning hdev->mgmtpending and treat MGMTOPSETLOCALNAME as an EIR/class-affecting pending command on the powered asynchronous path. Check for a conflicting pending command before copying the new short name so a rejected SETLOCALNAME request does not modify hdev->shortname.