CVE-2026-64409
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Every once in a while we see a hung btmtksdio_flush() task: INFO: task kworker/u17:0:189 blocked for more than 122 seconds. __cancel_work_timer+0x3f4/0x460 cancel_work_sync+0x1c/0x2c btmtksdio_flush+0x2c/0x40 hci_dev_open_sync+0x10c4/0x2190 [..] It all boils down to incorrect time_is_before_jiffies() usage in btmtksdio_txrx_work(). The btmtksdio_txrx_work() loop is expected to be terminated if running for longer than 5*HZ. However the timeout check is twisted: time_is_before_jiffies(old_jiffies + 5*HZ) evaluates to true when old_jiffies + 5*HZ is in the past i.e. when a timeout has occurred. Using OR with time_is_before_jiffies(txrx_timeout) means that: - before the 5-second timeout: the condition is `int_status || false`, so it loops as long as there are pending interrupts. - after the 5-second timeout: the condition becomes `int_status || true`, which is always true. When the loop becomes infinite btmtksdio_txrx_work() loop never terminates and never releases the SDIO host. Fix loop termination condition to actually enforce a 5*HZ timeout.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64409
EUVD
EUVD-2026-48953

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Bluetooth driver for MediaTek SDIO devices. It involves an infinite loop in the btmtksdio_txrx_work() function due to incorrect use of time_is_before_jiffies(). The loop is supposed to terminate after 5 seconds but instead continues indefinitely when a timeout occurs, causing the SDIO host to remain locked.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth SDIO driver (btmtksdio). Detection involves checking for hung tasks or infinite loops in the btmtksdio_txrx_work() function. Monitor kernel logs for blocked tasks or timeouts related to Bluetooth operations. Use commands like 'dmesg | grep -i blocked' or 'journalctl -k | grep -i hung' to identify hung tasks.

Impact Analysis

This vulnerability can cause system hangs or freezes when Bluetooth operations are performed. The infinite loop in btmtksdio_txrx_work() prevents the SDIO host from being released, potentially disrupting Bluetooth functionality and other SDIO-dependent operations.

Mitigation Strategies

Apply the kernel patch that fixes the incorrect time_is_before_jiffies() usage in btmtksdio_txrx_work(). Update to a patched kernel version. If immediate patching is not possible, disable the affected Bluetooth SDIO driver (btmtksdio) by blacklisting the module or disabling Bluetooth functionality until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart