BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution (twitter.com)

Is there even a good reason for bluetooth support to be implemented inside the kernel?

Note that Intel's advisory has since been corrected to say "All Linux kernel versions before 5.10 that support BlueZ" are affected. The fix is not in 5.9 nor any stable, so this is essentially a 0day.

For more details, see https://lwn.net/Articles/834325/ and other comments on the LWN article.

(other HN posting of this article here: https://news.ycombinator.com/item?id=24779230)

Worth noting the fix has been sent to linux-next instead and distros were not informed: https://twitter.com/mjg59/status/1316484882877435904

This seems like the kind of bug that makes mrrobot episodes seem plausible