PT-2026-64630 · Linux · Linux
CVE-2026-64409
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtksdio: fix infinite loop in btmtksdio txrx work()
Every once in a while we see a hung btmtksdio flush() task:
INFO: task kworker/u17:0:189 blocked for more than 122 seconds.
cancel work timer+0x3f4/0x460
cancel work sync+0x1c/0x2c
btmtksdio flush+0x2c/0x40
hci dev open sync+0x10c4/0x2190
[..]
It all boils down to incorrect time is before jiffies() usage in
btmtksdio txrx work(). The btmtksdio txrx work() loop is expected
to be terminated if running for longer than 5HZ. However the
timeout check is twisted: time is before jiffies(old jiffies + 5HZ)
evaluates to true when old jiffies + 5*HZ is in the past i.e. when a
timeout has occurred. Using OR with time is before jiffies(txrx timeout)
means that:
- before the 5-second timeout: the condition is
int status || false, so it loops as long as there are pending interrupts. - after the 5-second timeout: the condition becomes
int status || true, which is always true.
When the loop becomes infinite btmtksdio txrx work() loop never
terminates and never releases the SDIO host.
Fix loop termination condition to actually enforce a 5*HZ timeout.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux