The vulnerability exists in the Zephyr SDIO subsystem function sdio_io_rw_extended_helper() where it uses the max_blk_size value decoded from the SDIO card's CIS FUNCE tuple without validation. If the card reports max_blk_size as zero, the byte-I/O loop uses a step size of zero, causing the loop to spin indefinitely. This loop is executed while holding a per-card mutex, causing the calling thread to hang permanently and denying service to the SDIO peripheral and any dependent subsystems such as Wi-Fi. The attack vector requires physical insertion of a crafted or malfunctioning SDIO card. The fix returns an -EIO error if max_blk_size is zero, preventing the infinite loop.

The vulnerability causes a permanent denial of service by hanging the calling thread on the first non-block-aligned transfer when a malicious SDIO card reports a max block size of zero. This results in the SDIO peripheral and dependent subsystems becoming unavailable until the device is reset. There is no impact on confidentiality, integrity, or memory safety.

A fix is available that returns an error (-EIO) when the SDIO card reports a max block size of zero, preventing the infinite loop. Users should update to Zephyr version 4.4.2 or later where this issue is resolved. Since the vulnerability requires physical access to insert a malicious SDIO card, restricting physical access to devices with SDIO slots can also mitigate risk.