A logic error in the Linux kernel’s btmtksdio Bluetooth SDIO driver creates an infinite loop in btmtksdio_txrx_work(). After five seconds the timeout check always evaluates to true, so the loop never exits and the btmtksdio_flush task blocks indefinitely. The blocked task can prevent the SDIO host from releasing, effectively disabling the Bluetooth SDIO interface and can lead to a system hang through a local denial‑of‑service condition.

All Linux kernel builds that ship the btmtksdio driver before the recent patch are affected. This includes the official upstream kernel and any vendor derivatives that have not yet applied the loop‑termination fix. The vulnerability is present in any kernel version containing the original btmtksdio_txrx_work implementation.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of <1% shows a very low likelihood of exploitation and the vulnerability is not listed in CISA KEV. Based on the description, a local interaction with the Bluetooth SDIO interface could potentially trigger the faulty state, but the exact access requirement is not explicitly stated. The risk remains high if exploitation occurs, as the infinite loop could cause a kernel block and potentially a system hang.