Kernel crash via NULL socket error handling

NULL pointer dereference in the Linux Bluetooth L2CAP socket layer allows local users to crash the kernel during connection setup. The l2cap_sock_new_connection_cb path passes a NULL socket to l2cap_sock_alloc, whose failure cleanup dereferences the missing socket unless the pointer is checked. A local low-privileged process must reach this connection error path; the supported consequence is a kernel crash, with no reported data disclosure or modification.