CVE-2026-64409 Overview
CVE-2026-64409 is a Linux kernel vulnerability in the btmtksdio Bluetooth driver for MediaTek SDIO devices. The flaw exists in btmtksdio_txrx_work(), where an incorrect time_is_before_jiffies() check causes the transmit/receive work loop to run indefinitely. When the intended 5-second timeout expires, the loop condition evaluates to always-true, preventing the SDIO host from being released. Downstream calls such as btmtksdio_flush() and hci_dev_open_sync() then block, producing hung task warnings in kernel logs. The issue has been resolved upstream through multiple stable-tree backport commits.
Critical Impact
Local denial of service on affected Linux systems using MediaTek SDIO Bluetooth adapters. Kernel worker threads hang, blocking Bluetooth stack initialization and consuming SDIO host resources.
Affected Products
- Linux kernel builds including the btmtksdio Bluetooth SDIO driver
- Systems using MediaTek SDIO-attached Bluetooth controllers
- Stable kernel branches receiving backports referenced in the kernel commit set
Discovery Timeline
- 2026-07-25 - CVE-2026-64409 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64409
Vulnerability Analysis
The defect resides in the btmtksdio_txrx_work() worker routine within the MediaTek SDIO Bluetooth driver. The loop is designed to process pending SDIO interrupts and terminate once either interrupts drain or 5 seconds elapse. The termination logic uses the time_is_before_jiffies() macro incorrectly, inverting the semantics of the timeout comparison.
Before the 5-second boundary passes, the compound condition reduces to int_status || false, so the loop iterates while interrupts remain. Once old_jiffies + 5*HZ is in the past, the second operand becomes true, producing int_status || true, which never breaks. The worker then holds the SDIO host indefinitely.
Hung tasks surface through the standard kernel watchdog with messages such as INFO: task kworker/u17:0:189 blocked for more than 122 seconds, with stack traces through __cancel_work_timer, cancel_work_sync, btmtksdio_flush, and hci_dev_open_sync. Categorization is Infinite Loop leading to Denial of Service.
Root Cause
The root cause is inverted use of the time_is_before_jiffies() helper. The macro returns true when the supplied timestamp is already in the past, but the code treats it as if it returned true only before the deadline. This logic error, combined with the OR conjunction against int_status, guarantees an unbreakable loop after the timeout threshold.
Attack Vector
The vulnerability is triggered under normal operating conditions on hardware exposing sustained SDIO Bluetooth interrupt activity. A local attacker with the ability to influence Bluetooth traffic patterns on an affected adapter could reliably induce the hang, degrading availability of the Bluetooth subsystem and any workflows that depend on hci_dev_open_sync(). Remote exploitation over the air is not established in the advisory data.
No public exploit code is required. The vulnerable path is described in the upstream commit series. See the Linux Kernel Commit 0039bdde and Linux Kernel Commit f6682c23 for the fix as merged across stable branches.
Detection Methods for CVE-2026-64409
Indicators of Compromise
- Kernel log entries reporting INFO: task kworker/... blocked for more than 122 seconds with stack frames including btmtksdio_flush and btmtksdio_txrx_work
- Repeated hangs of hci_dev_open_sync during Bluetooth initialization or reset
- SDIO host contention where the MediaTek Bluetooth work queue never releases the bus
Detection Strategies
- Parse dmesg and /var/log/kern.log for hung task warnings referencing btmtksdio symbols
- Correlate Bluetooth service failures (BlueZ bluetoothd errors, hciconfig timeouts) with kernel worker stalls
- Inventory running kernels against the fixed commits in the stable-tree references to identify unpatched hosts
Monitoring Recommendations
- Alert on kernel hung_task events and worker thread blockage exceeding the default 120-second threshold
- Track Bluetooth stack restart frequency on fleet endpoints using MediaTek SDIO radios
- Forward kernel telemetry to a centralized log platform for pattern analysis across affected devices
How to Mitigate CVE-2026-64409
Immediate Actions Required
- Update to a Linux kernel version that includes the upstream fix corresponding to your stable branch
- On systems that cannot be patched immediately, unload the btmtksdio module when Bluetooth is not required
- Restart affected hosts exhibiting hung kworker threads to release the SDIO host
Patch Information
The fix corrects the loop termination condition in btmtksdio_txrx_work() so a 5*HZ timeout is actually enforced. Backports are available across multiple stable trees. Reference the following commits: 0039bdde, 0f0a83e2, 466540e0, 7b429d61, a257407e, and f6682c23.
Workarounds
- Disable the MediaTek SDIO Bluetooth adapter via BIOS or rfkill block bluetooth where the functionality is not needed
- Blacklist the btmtksdio kernel module until a patched kernel is deployed
- Increase monitoring on affected hosts and schedule proactive reboots if hung task warnings appear
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
