PT-2026-64630 · Linux · Linux
CVE-2026-64409
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtksdio: fix infinite loop in btmtksdio txrx work()
Every once in a while we see a hung btmtksdio flush() task:
INFO: task kworker/u17:0:189 blocked for more than 122 seconds.
cancel work timer+0x3f4/0x460
cancel work sync+0x1c/0x2c
btmtksdio flush+0x2c/0x40
hci dev open sync+0x10c4/0x2190
[..]
It all boils down to incorrect time is before jiffies() usage in
btmtksdio txrx work(). The btmtksdio txrx work() loop is expected
to be terminated if running for longer than 5HZ. However the
timeout check is twisted: time is before jiffies(old jiffies + 5HZ)
evaluates to true when old jiffies + 5*HZ is in the past i.e. when a
timeout has occurred. Using OR with time is before jiffies(txrx timeout)
means that:
- before the 5-second timeout: the condition is
int status || false, so it loops as long as there are pending interrupts. - after the 5-second timeout: the condition becomes
int status || true, which is always true.
When the loop becomes infinite btmtksdio txrx work() loop never
terminates and never releases the SDIO host.
Fix loop termination condition to actually enforce a 5*HZ timeout.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux