Executive brief
A flaw in the Linux kernel's MediaTek Bluetooth SDIO driver can cause the system to hang or become unresponsive. This occurs because a specific internal task can enter an infinite loop, preventing the system from completing other operations. This primarily impacts the availability of the device, potentially requiring a hard reboot to restore service.
Technical details
A logic error in the btmtksdio_txrx_work() function in drivers/bluetooth/btmtksdio.c causes an infinite loop. The loop was intended to terminate after 5 seconds (5*HZ), but used an 'OR' condition with an incorrectly implemented time_is_before_jiffies() check. Once the 5-second threshold is reached, the condition evaluates to true regardless of interrupt status, causing the kworker to hang and never release the SDIO host. This results in a denial-of-service (DoS) for Bluetooth functionality and potentially the wider system. The issue has been resolved by switching to an 'AND' condition with time_is_after_jiffies().
Affected products
- Linux Linux Kernel 5.17 to 6.9.x
Timeline
- 2026-06-09: disclosed: Initial patch submitted by Sergey Senozhatsky
- 2026-07-18: patched: Patch committed to stable branches
- 2026-07-25: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0039bdde36b23ccf1196635f1d52c5490481544d
- https://git.kernel.org/stable/c/0f0a83e26a9c7fd4b243c315ce07161d2496d83d
- https://git.kernel.org/stable/c/466540e045d01fcacf383a5beb8a2dad2fc53a26
- https://git.kernel.org/stable/c/7b429d611060e87752e848851815537963726493
- https://git.kernel.org/stable/c/a257407e2bbbb099ed427719a50563f67fa366d8
- https://git.kernel.org/stable/c/f6682c23b6fac4780d297ae4662053d17e58fd52