Skip to main content

Linux Kernel EUVDEUVD-2026-48953

| CVE-2026-64409 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-25 Linux GHSA-x8qw-hc9f-qxq2
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege access needed to interact with Bluetooth subsystem; impact is availability-only; hardware-specific driver limits scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Sep 04, 2026 - 16:07 vuln.today
CVSS changed
Sep 04, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()

Every once in a while we see a hung btmtksdio_flush() task:

INFO: task kworker/u17:0:189 blocked for more than 122 seconds. __cancel_work_timer+0x3f4/0x460 cancel_work_sync+0x1c/0x2c btmtksdio_flush+0x2c/0x40 hci_dev_open_sync+0x10c4/0x2190 [..]

It all boils down to incorrect time_is_before_jiffies() usage in btmtksdio_txrx_work(). The btmtksdio_txrx_work() loop is expected to be terminated if running for longer than 5*HZ. However the timeout check is twisted: time_is_before_jiffies(old_jiffies + 5*HZ) evaluates to true when old_jiffies + 5*HZ is in the past i.e. when a timeout has occurred. Using OR with time_is_before_jiffies(txrx_timeout) means that:

  • before the 5-second timeout: the condition is int_status || false,

so it loops as long as there are pending interrupts.

  • after the 5-second timeout: the condition becomes int_status || true,

which is always true.

When the loop becomes infinite btmtksdio_txrx_work() loop never terminates and never releases the SDIO host.

Fix loop termination condition to actually enforce a 5*HZ timeout.

AnalysisAI

Denial of service in the Linux kernel btmtksdio (MediaTek Bluetooth SDIO) driver allows a local attacker with low privileges to permanently hang the Bluetooth stack by triggering an infinite loop in btmtksdio_txrx_work(). The root cause is an inverted timeout logic: a misused time_is_before_jiffies() call, combined via OR, causes the worker loop's exit condition to become unconditionally true after the 5-second timeout fires, so the loop never terminates and never releases the SDIO host. No public exploit has been identified at time of analysis; however, the bug can also trigger organically under hardware stress conditions.

Technical ContextAI

The affected component is btmtksdio, the Linux kernel driver for MediaTek Bluetooth chipsets attached over SDIO (Secure Digital Input/Output bus). The driver implements a transmit/receive worker function btmtksdio_txrx_work() that processes pending interrupt statuses in a loop bounded by a 5×HZ deadline. The bug (CWE-835, Loop with Unreachable Exit Condition) arises because the boolean exit guard uses time_is_before_jiffies(old_jiffies + 5*HZ) - which evaluates TRUE once the deadline has elapsed - then OR-combines it with the interrupt-status flag. After the 5-second window, the compound condition is always TRUE regardless of int_status, producing an unbounded loop. The loop holds the SDIO host lock throughout, causing btmtksdio_flush() (called during hci_dev_open_sync()) to block indefinitely on cancel_work_sync(). CPE cpe:2.3:a:linux:linux covers all affected stable lines; the regressing commit is 26270bc189ea4b5a8356ec99561357fc87f00b32 introduced in Linux 5.17.

RemediationAI

Upgrade to a patched stable kernel release: 6.1.178 or later in the 6.1.x LTS series, 6.6.145 or later in the 6.6.x LTS series, 6.12.96 or later in the 6.12.x series, 6.18.39 or later in the 6.18.x series, or 7.1.4 / 7.2-rc1 in mainline. Patch commits are available at git.kernel.org/stable (refs: f6682c23b6fa, 466540e045d0, 7b429d611060, 0039bdde36b2, 0f0a83e26a9c, a257407e2bbb). If an immediate kernel upgrade is not possible, a compensating control is to disable the btmtksdio Bluetooth adapter via 'hciconfig hci0 down' or by blacklisting the btmtksdio module ('echo btmtksdio >> /etc/modprobe.d/blacklist.conf'), which eliminates the attack surface at the cost of losing Bluetooth functionality on the MediaTek SDIO adapter.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.184 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.186 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.180 Affected
SUSE Linux Enterprise Real Time 15 SP7 SUSE Real Time Module 15 SP7 Fixed
SUSE Linux Micro 6.0 Fixed

Share

EUVD-2026-48953 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy