CVE-2026-64409

Analyzed Analyzed - Analysis Complete

Bluetooth: Infinite Loop in btmtksdio_txrx_work() in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() Every once in a while we see a hung btmtksdio_flush() task: INFO: task kworker/u17:0:189 blocked for more than 122 seconds. __cancel_work_timer+0x3f4/0x460 cancel_work_sync+0x1c/0x2c btmtksdio_flush+0x2c/0x40 hci_dev_open_sync+0x10c4/0x2190 [..] It all boils down to incorrect time_is_before_jiffies() usage in btmtksdio_txrx_work(). The btmtksdio_txrx_work() loop is expected to be terminated if running for longer than 5*HZ. However the timeout check is twisted: time_is_before_jiffies(old_jiffies + 5*HZ) evaluates to true when old_jiffies + 5*HZ is in the past i.e. when a timeout has occurred. Using OR with time_is_before_jiffies(txrx_timeout) means that: - before the 5-second timeout: the condition is `int_status || false`, so it loops as long as there are pending interrupts. - after the 5-second timeout: the condition becomes `int_status || true`, which is always true. When the loop becomes infinite btmtksdio_txrx_work() loop never terminates and never releases the SDIO host. Fix loop termination condition to actually enforce a 5*HZ timeout.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64409

EUVD

EUVD-2026-48953

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 5.17 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's Bluetooth driver for MediaTek SDIO devices. It involves an infinite loop in the btmtksdio_txrx_work() function due to incorrect use of time_is_before_jiffies(). The loop is supposed to terminate after 5 seconds but instead continues indefinitely when a timeout occurs, causing the SDIO host to remain locked.

Detection Guidance

This vulnerability is specific to the Linux kernel's Bluetooth SDIO driver (btmtksdio). Detection involves checking for hung tasks or infinite loops in the btmtksdio_txrx_work() function. Monitor kernel logs for blocked tasks or timeouts related to Bluetooth operations. Use commands like 'dmesg | grep -i blocked' or 'journalctl -k | grep -i hung' to identify hung tasks.

Impact Analysis

This vulnerability can cause system hangs or freezes when Bluetooth operations are performed. The infinite loop in btmtksdio_txrx_work() prevents the SDIO host from being released, potentially disrupting Bluetooth functionality and other SDIO-dependent operations.

Compliance Impact

This vulnerability causes an infinite loop in the Linux kernel's Bluetooth driver, leading to system hangs. It does not directly impact data confidentiality, integrity, or availability in a way that would violate GDPR or HIPAA requirements. However, system unavailability due to hangs could indirectly affect compliance if it disrupts critical services handling personal or health data.

Mitigation Strategies

Apply the kernel patch that fixes the incorrect time_is_before_jiffies() usage in btmtksdio_txrx_work(). Update to a patched kernel version. If immediate patching is not possible, disable the affected Bluetooth SDIO driver (btmtksdio) by blacklisting the module or disabling Bluetooth functionality until the patch is applied.

Hi! I’m here to help you understand CVE-2026-64409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70