Junglewise Threat Intelligence

CVE-2026-64409: Linux Kernel infinite loop in btmtksdio driver

CVE-2026-64409 · Severity: info · CVSS 5.5 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A flaw in the Linux kernel's MediaTek Bluetooth SDIO driver can cause the system to hang or become unresponsive. This occurs because a specific internal task can enter an infinite loop, preventing the system from completing other operations. This primarily impacts the availability of the device, potentially requiring a hard reboot to restore service.

Technical details

A logic error in the btmtksdio_txrx_work() function in drivers/bluetooth/btmtksdio.c causes an infinite loop. The loop was intended to terminate after 5 seconds (5*HZ), but used an 'OR' condition with an incorrectly implemented time_is_before_jiffies() check. Once the 5-second threshold is reached, the condition evaluates to true regardless of interrupt status, causing the kworker to hang and never release the SDIO host. This results in a denial-of-service (DoS) for Bluetooth functionality and potentially the wider system. The issue has been resolved by switching to an 'AND' condition with time_is_after_jiffies().

Affected products

  • Linux Linux Kernel 5.17 to 6.9.x

Timeline

  • 2026-06-09: disclosed: Initial patch submitted by Sergey Senozhatsky
  • 2026-07-18: patched: Patch committed to stable branches
  • 2026-07-25: advisory: NVD publication date

References

Related threats