From 49721e7c248e5e74bc380f370144e0358d1ddfc9 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Sun, 5 Jul 2026 05:09:14 +0000
Subject: [PATCH] bluez5: upgrade 5.86 -> 5.87

---
 meta/recipes-connectivity/bluez5/bluez5.inc   |   7 --
 ...ell-Don-t-init-input-for-non-interac.patch |  42 -------
 ...sending-extra-bytes-with-MGMT_OP_ADD.patch |  33 -----
 ...use-after-free-caused-by-reentrant-c.patch |  59 ---------
 ...2CAP-IMTU-for-OBEX-profile-listeners.patch | 118 ------------------
 ...x-stored-gatt-cache-DB-Hash-value-no.patch |  84 -------------
 ...et-for-building-tests-without-runnin.patch |   6 +-
 ...d-broken-stdin-handling-in-home-made.patch |  36 ------
 ...t-volume-failure-with-invalid-device.patch |  46 -------
 .../bluez5/{bluez5_5.86.bb => bluez5_5.87.bb} |   2 +-
 10 files changed, 4 insertions(+), 429 deletions(-)
 delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch
 delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch
 delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch
 delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch
 delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch
 delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-tools-Work-around-broken-stdin-handling-in-home-made.patch
 delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch
 rename meta/recipes-connectivity/bluez5/{bluez5_5.86.bb => bluez5_5.87.bb} (95%)

diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc
index 4bf4fce506..8d2e1e8f42 100644
--- a/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -68,13 +68,6 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
            file://init \
            file://run-ptest \
            file://0001-tests-add-a-target-for-building-tests-without-runnin.patch \
-           file://0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch \
-           file://0001-tools-Work-around-broken-stdin-handling-in-home-made.patch \
-           file://0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch \
-           file://0001-transport-Fix-set-volume-failure-with-invalid-device.patch \
-           file://0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch \
-           file://0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch    \
-           file://0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch \
            "
 S = "${UNPACKDIR}/bluez-${PV}"
 
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch
deleted file mode 100644
index a0271513eb..0000000000
--- a/meta/recipes-connectivity/bluez5/bluez5/0001-Revert-shared-shell-Don-t-init-input-for-non-interac.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From b33e923b55e4d0e9d78a83cfcb541fd1f687ef54 Mon Sep 17 00:00:00 2001
-From: Bastien Nocera <hadess@hadess.net>
-Date: Fri, 27 Feb 2026 12:27:17 +0100
-Subject: [PATCH] Revert "shared/shell: Don't init input for non-interactive
- shells"
-
-This reverts commit e73bf582dae60356641a32fc27ae03d359ec4c47.
-
-The fix caused "bluetoothctl list" to not output any text, breaking
-a lot of existing scripts.
-
-Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2440346
-
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/b33e923b55e4d0e9d78a83cfcb541fd1f687ef54]
-Signed-off-by: Leonardo Costa <leonardo.costa@toradex.com>
----
- src/shared/shell.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/src/shared/shell.c b/src/shared/shell.c
-index 78d58c513..b061f8001 100644
---- a/src/shared/shell.c
-+++ b/src/shared/shell.c
-@@ -1642,13 +1642,13 @@ static bool shell_quit(void *data)
- 
- bool bt_shell_attach(int fd)
- {
--	if (data.mode == MODE_INTERACTIVE) {
--		struct input *input;
-+	struct input *input;
- 
--		input = input_new(fd);
--		if (!input)
--			return false;
-+	input = input_new(fd);
-+	if (!input)
-+		return false;
- 
-+	if (data.mode == MODE_INTERACTIVE) {
- 		io_set_read_handler(input->io, input_read, input, NULL);
- 		io_set_disconnect_handler(input->io, input_hup, input, NULL);
- 
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch
deleted file mode 100644
index 0a73741367..0000000000
--- a/meta/recipes-connectivity/bluez5/bluez5/0001-advertising-Fix-sending-extra-bytes-with-MGMT_OP_ADD.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From b16441fbb7a24325f7c7d0c5ecedc88b46ddd439 Mon Sep 17 00:00:00 2001
-From: Xiuzhuo Shang <xiuzhuo.shang@oss.qualcomm.com>
-Date: Thu, 4 Jun 2026 17:32:27 +0800
-Subject: [PATCH] advertising: Fix sending extra bytes with
- MGMT_OP_ADD_EXT_ADV_DATA
-
-MGMT_OP_ADD_EXT_ADV_DATA expects the command to be of size of
-struct mgmt_cp_add_ext_adv_data not mgmt_cp_add_advertising.
-
-Upstream-Status: Backport [2a6968b40378dca5650e18e03ad0407738c47be5]
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Signed-off-by: Xiuzhuo Shang <xiuzhuo.shang@oss.qualcomm.com>
----
- src/advertising.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/src/advertising.c b/src/advertising.c
-index 8970e65f7..0cb37d4ae 100644
---- a/src/advertising.c
-+++ b/src/advertising.c
-@@ -1487,8 +1487,7 @@ static void add_adv_params_callback(uint8_t status, uint16_t length,
- 		}
- 	}
- 
--	param_len = sizeof(struct mgmt_cp_add_advertising) + adv_data_len +
--							scan_rsp_len;
-+	param_len = sizeof(*cp) + adv_data_len + scan_rsp_len;
- 
- 	cp = malloc0(param_len);
- 	if (!cp) {
--- 
-2.43.0
-
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch
deleted file mode 100644
index 0fcbc0808a..0000000000
--- a/meta/recipes-connectivity/bluez5/bluez5/0001-gatt-client-Fix-use-after-free-caused-by-reentrant-c.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 45c167591d04e2dfecf5b4642168e54c23abbd40 Mon Sep 17 00:00:00 2001
-From: Jinwang Li <jinwang.li@oss.qualcomm.com>
-Date: Sun, 26 Apr 2026 21:25:15 +0800
-Subject: [PATCH 2/2] gatt-client: Fix use-after-free caused by reentrant
- client teardown
-
-btd_gatt_client_service_removed() can be called reentrantly via
-bt_gatt_client_unref() after the services queue has already been freed,
-resulting in a use-after-free.
-
-Reset client->ready to false before destroying the services queue to
-prevent reentrant calls from dereferencing freed memory.
-
-This was found with the following backtrace:
-
-    #0  match_service_handle ()
-    #1  queue_remove_if ()
-    #2  queue_remove_all ()
-    #3  btd_gatt_client_service_removed ()
-    #4  gatt_service_removed ()
-    #5  handle_notify ()
-    #6  queue_foreach ()
-    #7  notify_service_changed ()
-    #8  gatt_db_service_destroy ()
-    #9  queue_remove_all ()
-    #10 gatt_db_clear_range ()
-    #11 service_changed_failure ()
-    #12 discovery_op_unref ()
-    #13 bt_gatt_request_unref ()
-    #14 bt_gatt_client_cancel_all ()
-    #15 bt_gatt_client_free ()
-    #16 bt_gatt_client_unref ()
-    #17 bt_gatt_client_free ()
-    #18 bt_gatt_client_unref ()
-    #19 btd_gatt_client_destroy ()
-    #20 device_free ()
-
-Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
-Upstream-Status: Backport [commit d01616f0c276a441dad8afe4e8f7bb261b26ba0a]
----
- src/gatt-client.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/gatt-client.c b/src/gatt-client.c
-index 374e67c..3baf95c 100644
---- a/src/gatt-client.c
-+++ b/src/gatt-client.c
-@@ -2261,6 +2261,8 @@ void btd_gatt_client_destroy(struct btd_gatt_client *client)
- 	if (!client)
- 		return;
- 
-+	client->ready = false;
-+
- 	queue_destroy(client->services, unregister_service);
- 	queue_destroy(client->all_notify_clients, NULL);
- 	queue_destroy(client->ios, NULL);
--- 
-2.34.1
-
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch
deleted file mode 100644
index 332b11464e..0000000000
--- a/meta/recipes-connectivity/bluez5/bluez5/0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 646014a6a246fe99df27da12d2de7bcd2e04d0df Mon Sep 17 00:00:00 2001
-From: Wei Deng <wei.deng@oss.qualcomm.com>
-Date: Thu, 4 Jun 2026 15:00:24 +0530
-Subject: [PATCH] profile: Set L2CAP IMTU for OBEX profile listeners
-
-The default_settings entries for OBEX profiles (OPP, FTP, PBAP, MAS,
-MNS) have no imtu field, so ext_start_servers() creates the L2CAP
-listening socket without an explicit IMTU. This causes the socket to
-advertise the L2CAP minimum of 672 bytes in L2CAP_CONFIGURATION_RSP,
-limiting the peer's outgoing PDU size and degrading Rx throughput.
-
-Add an imtu field to default_settings and set it to 32767 for all
-OBEX profiles that use L2CAP. Copy the value in ext_set_defaults()
-and apply it to the listening socket via bt_io_set() after
-bt_io_listen() succeeds.
-
-Signed-off-by: Wei Deng <wei.deng@oss.qualcomm.com>
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/646014a6a246fe99df27da12d2de7bcd2e04d0df]
----
- src/profile.c | 19 +++++++++++++++++--
- 1 file changed, 17 insertions(+), 2 deletions(-)
-
-diff --git a/src/profile.c b/src/profile.c
-index dfc5f7161..65df0f7a0 100644
---- a/src/profile.c
-+++ b/src/profile.c
-@@ -55,6 +55,8 @@
- #define MAS_DEFAULT_CHANNEL	16
- #define MNS_DEFAULT_CHANNEL	17
- 
-+#define BT_RX_MTU		32767
-+
- #define BTD_PROFILE_PSM_AUTO	-1
- #define BTD_PROFILE_CHAN_AUTO	-1
- 
-@@ -678,6 +680,7 @@ struct ext_profile {
- 
- 	uint16_t version;
- 	uint16_t features;
-+	uint16_t imtu;
- 
- 	GSList *records;
- 	GSList *servers;
-@@ -1423,6 +1426,9 @@ static uint32_t ext_start_servers(struct ext_profile *ext,
- 			if (psm == 0)
- 				bt_io_get(io, NULL, BT_IO_OPT_PSM, &psm,
- 							BT_IO_OPT_INVALID);
-+			if (ext->imtu)
-+				bt_io_set(io, NULL, BT_IO_OPT_IMTU, ext->imtu,
-+							BT_IO_OPT_INVALID);
- 			l2cap->io = io;
- 			l2cap->proto = BTPROTO_L2CAP;
- 			l2cap->psm = psm;
-@@ -2075,6 +2081,7 @@ static struct default_settings {
- 					struct ext_io *rfcomm);
- 	uint16_t	version;
- 	uint16_t	features;
-+	uint16_t	imtu;
- } defaults[] = {
- 	{
- 		.uuid		= SPP_UUID,
-@@ -2142,6 +2149,7 @@ static struct default_settings {
- 		.authorize	= false,
- 		.get_record	= get_opp_record,
- 		.version	= 0x0102,
-+		.imtu		= BT_RX_MTU,
- 	}, {
- 		.uuid		= OBEX_FTP_UUID,
- 		.name		= "File Transfer",
-@@ -2151,6 +2159,7 @@ static struct default_settings {
- 		.authorize	= true,
- 		.get_record	= get_ftp_record,
- 		.version	= 0x0103,
-+		.imtu		= BT_RX_MTU,
- 	}, {
- 		.uuid		= OBEX_SYNC_UUID,
- 		.name		= "Synchronization",
-@@ -2167,6 +2176,7 @@ static struct default_settings {
- 		.authorize	= true,
- 		.get_record	= get_pse_record,
- 		.version	= 0x0101,
-+		.imtu		= BT_RX_MTU,
- 	}, {
- 		.uuid		= OBEX_PCE_UUID,
- 		.name		= "Phone Book Access Client",
-@@ -2182,7 +2192,8 @@ static struct default_settings {
- 		.mode		= BT_IO_MODE_ERTM,
- 		.authorize	= true,
- 		.get_record	= get_mas_record,
--		.version	= 0x0100
-+		.version	= 0x0100,
-+		.imtu		= BT_RX_MTU,
- 	}, {
- 		.uuid		= OBEX_MNS_UUID,
- 		.name		= "Message Notification",
-@@ -2191,7 +2202,8 @@ static struct default_settings {
- 		.mode		= BT_IO_MODE_ERTM,
- 		.authorize	= true,
- 		.get_record	= get_mns_record,
--		.version	= 0x0104
-+		.version	= 0x0104,
-+		.imtu		= BT_RX_MTU,
- 	},
- };
- 
-@@ -2249,6 +2261,9 @@ static void ext_set_defaults(struct ext_profile *ext)
- 		if (settings->features)
- 			ext->features = settings->features;
- 
-+		if (settings->imtu)
-+			ext->imtu = settings->imtu;
-+
- 		if (settings->name)
- 			ext->name = g_strdup(settings->name);
- 	}
--- 
-2.34.1
-
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch
deleted file mode 100644
index 69323bdc5e..0000000000
--- a/meta/recipes-connectivity/bluez5/bluez5/0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 9ec8cad56e47c0555a056e928e6568d543b3ae0c Mon Sep 17 00:00:00 2001
-From: Mengshi Wu <mengshi.wu@oss.qualcomm.com>
-Date: Wed, 1 Apr 2026 19:30:04 +0800
-Subject: [PATCH v1] src/device: Fix stored gatt cache DB Hash value not update
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There is an asymmetry in behavior: when services are added during
-the same connection (via Service Changed indication), the persistent
-storage (disk) is not updated with the new DB hash, but when services
-are removed, it is updated.
-
-During the same connection, We check DB hash value stored at
-/var/lib/bluetooth/<adaptor addr>/cache/<remote addr>.
-When established connection, the stored DB Hash value is A.Then we
-add new services, the stored DB Hash value is still A which should
-change to B. However, if we remove the existing services, the stored
-DB Hash value changed to C.
-
-When performing addition, it goes like this:
-
-discover_primary_cb()
-  └─> gatt_db_insert_service()      ← NEW service inserted into db
-        └─> gatt_service_added()    ← callback fires immediately
-              └─> store_gatt_db()   ← SAVED TO DISK (hash still OLD)
-  ...
-  └─> discovery_op_complete(success=true)
-        └─> read_db_hash(op)             ← sends ATT Read By Type
-              └─> [ATT response arrives]
-                    └─> db_hash_read_cb()
-                          ├─> gatt_db_attribute_write(op->hash, ...)
-                          │     └─> hash UPDATED IN MEMORY
-                          └─> discovery_op_complete(true, 0)
-                                ├─> [no services to remove, no
-                                │    store_gatt_db called]
-                                └─> service_changed_complete()
-
-Whereas removal perform like this:
-discovery_op_complete(success=true)  [1st call]
-  └─> read_db_hash(op)
-      └─> op->hash is NULL → sends ATT request → early return
-...
-[ATT response arrives]
-db_hash_read_cb()
-  └─> gatt_db_attribute_write(op->hash, ) ← hash UPDATED IN MEMORY
-  └─> discovery_op_complete(true, 0)          [2nd call]
-      └─> read_db_hash(op)  → op->hash already set → returns false
-      └─> gatt_db_remove_service()
-          └─> gatt_service_removed()
-              └─> store_gatt_db() ← SAVED TO DISK (hash is NEW)
-
-There is a timing issue to update DB Hash value.
-
-The gatt_client_service_changed() callback in src/device.c is called
-from service_changed_complete() in gatt-client.c, which is invoked
-after db_hash_read_cb() has already updated the hash. Adding
-store_gatt_db(device) here guarantees the db is persisted with the
-correct, up-to-date hash for both the addition and removal cases.
-
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/0fd01e98cf94616a5c1c39749314cdd4a1654687]
-Signed-off-by: Mengshi Wu <mengshi.wu@oss.qualcomm.com>
----
- src/device.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/device.c b/src/device.c
-index 3ea683667..cfbde307b 100644
---- a/src/device.c
-+++ b/src/device.c
-@@ -6267,7 +6267,11 @@ static void gatt_client_service_changed(uint16_t start_handle,
- 							uint16_t end_handle,
- 							void *user_data)
- {
-+	struct btd_device *device = user_data;
-+
- 	DBG("start 0x%04x, end: 0x%04x", start_handle, end_handle);
-+
-+	store_gatt_db(device);
- }
-
- static void gatt_debug(const char *str, void *user_data)
---
-2.34.1
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-tests-add-a-target-for-building-tests-without-runnin.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-tests-add-a-target-for-building-tests-without-runnin.patch
index cea7c10c3d..0fc15c75a0 100644
--- a/meta/recipes-connectivity/bluez5/bluez5/0001-tests-add-a-target-for-building-tests-without-runnin.patch
+++ b/meta/recipes-connectivity/bluez5/bluez5/0001-tests-add-a-target-for-building-tests-without-runnin.patch
@@ -1,4 +1,4 @@
-From d8bbdd8e7166f481429b4999f520cd8306685f03 Mon Sep 17 00:00:00 2001
+From e7407ddb1b52308d4b69036da94bbd6021f0c7ab Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Fri, 1 Apr 2016 17:07:34 +0300
 Subject: [PATCH] tests: add a target for building tests without running them
@@ -10,10 +10,10 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/Makefile.am b/Makefile.am
-index 94f625d..a3c3512 100644
+index 76c4ab5..91a6277 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -725,6 +725,9 @@ endif
+@@ -812,6 +812,9 @@ endif
  TESTS = $(unit_tests)
  AM_TESTS_ENVIRONMENT = MALLOC_CHECK_=3 MALLOC_PERTURB_=69
  
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-tools-Work-around-broken-stdin-handling-in-home-made.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-tools-Work-around-broken-stdin-handling-in-home-made.patch
deleted file mode 100644
index c362936bc2..0000000000
--- a/meta/recipes-connectivity/bluez5/bluez5/0001-tools-Work-around-broken-stdin-handling-in-home-made.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 21e13976f2e375d701b8b7032ba5c1b2e56c305f Mon Sep 17 00:00:00 2001
-From: Bastien Nocera <hadess@hadess.net>
-Date: Fri, 27 Feb 2026 12:27:18 +0100
-Subject: [PATCH] tools: Work-around broken stdin handling in home-made
- mainloop
-
-bluetoothd has 3 mainloop implementations, one relying on ell, one
-relying on glib, and another home-made.
-
-The home-made mainloop handler use epoll() without any fallbacks, and
-will hang if one tries to epoll() an stdin that redirects from
-/dev/null.
-
-Closes: https://github.com/bluez/bluez/issues/700
-
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/b33e923b55e4d0e9d78a83cfcb541fd1f687ef54]
-Signed-off-by: Leonardo Costa <leonardo.costa@toradex.com>
----
- Makefile.tools | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Makefile.tools b/Makefile.tools
-index 589f7c94f..7c52e053f 100644
---- a/Makefile.tools
-+++ b/Makefile.tools
-@@ -531,8 +531,8 @@ tools_obexctl_LDADD = gdbus/libgdbus-internal.la src/libshared-glib.la \
- 
- tools_btmgmt_SOURCES = tools/btmgmt.c src/uuid-helper.c client/display.c \
- 			client/mgmt.c
--tools_btmgmt_LDADD = lib/libbluetooth-internal.la src/libshared-mainloop.la \
--				-lreadline
-+tools_btmgmt_LDADD = lib/libbluetooth-internal.la src/libshared-glib.la \
-+				$(GLIB_LIBS) -lreadline
- if DEPRECATED
- noinst_PROGRAMS += attrib/gatttool
- 
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch
deleted file mode 100644
index b5846dec47..0000000000
--- a/meta/recipes-connectivity/bluez5/bluez5/0001-transport-Fix-set-volume-failure-with-invalid-device.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 8a80f70c23ca5f93b1db7e3956cc7ee28c1fa767 Mon Sep 17 00:00:00 2001
-From: Jinwang Li <jinwang.li@oss.qualcomm.com>
-Date: Mon, 9 Mar 2026 19:18:26 +0800
-Subject: [PATCH] transport: Fix set volume failure with invalid device volume
-
-When AVRCP is connected before AVDTP, an invalid device volume causes
-the target to reject registration for the EVENT_VOLUME_CHANGED
-notification, which breaks subsequent volume updates.
-
-Fix this by initializing the volume to the maximum value in the AVRCP
-target init path when it is invalid, allowing the controller to
-subscribe to AVRCP_EVENT_VOLUME_CHANGED.
-
-Fixes: fa7828bddd21 ("transport: Fix not being able to initialize volume properly")
-Suggested-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
-Upstream-Status: Backport [https://github.com/bluez/bluez/commit/121e5ca79be559c5374f8a54c6fb6e233e383379]
----
- profiles/audio/avrcp.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
-index 724b46c59..326dfdab7 100644
---- a/profiles/audio/avrcp.c
-+++ b/profiles/audio/avrcp.c
-@@ -4296,9 +4296,16 @@ static void target_init(struct avrcp *session)
- 	if (target->version < 0x0104)
- 		return;
- 
--	if (avrcp_volume_supported(target))
-+	if (avrcp_volume_supported(target)) {
- 		session->supported_events |=
- 				(1 << AVRCP_EVENT_VOLUME_CHANGED);
-+		/* Check if transport volume hasn't been initialized then set it
-+		 * to max so it works properly if the controller attempts to
-+		 * subscribe to AVRCP_EVENT_VOLUME_CHANGED.
-+		 */
-+		if (media_transport_get_a2dp_volume(session->dev) < 0)
-+			media_transport_set_a2dp_volume(session->dev, 127);
-+	}
- 
- 	session->supported_events |=
- 				(1 << AVRCP_EVENT_ADDRESSED_PLAYER_CHANGED) |
--- 
-2.34.1
-
diff --git a/meta/recipes-connectivity/bluez5/bluez5_5.86.bb b/meta/recipes-connectivity/bluez5/bluez5_5.87.bb
similarity index 95%
rename from meta/recipes-connectivity/bluez5/bluez5_5.86.bb
rename to meta/recipes-connectivity/bluez5/bluez5_5.87.bb
index 8974a2c69c..75b765d524 100644
--- a/meta/recipes-connectivity/bluez5/bluez5_5.86.bb
+++ b/meta/recipes-connectivity/bluez5/bluez5_5.87.bb
@@ -2,7 +2,7 @@ require bluez5.inc
 
 LDFLAGS += " ${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-lld', '-Wl,-z,nostart-stop-gc', '', d)}"
 
-SRC_URI[sha256sum] = "99f144540c6070591e4c53bcb977eb42664c62b7b36cb35a29cf72ded339621d"
+SRC_URI[sha256sum] = "26bdcf2cebd7310c6f598850606b037ef0c515fe6608ebc54d22c50c4c32b35f"
 
 CVE_STATUS[CVE-2020-24490] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes"
 CVE_STATUS[CVE-2020-12351] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes"
-- 
2.47.1

