The Linux kernel Bluetooth driver btmtksdio had a bug in the btmtksdio_txrx_work() function where the timeout check used time_is_before_jiffies() incorrectly. The loop was intended to terminate if running longer than 5*HZ (5 seconds), but the condition combined interrupt status and timeout checks with an OR operator, causing the loop to never exit after the timeout. This led to an infinite loop, blocking the SDIO host and causing the btmtksdio_flush() task to hang. The fix corrected the loop termination condition to properly enforce the timeout and prevent the infinite loop.

The vulnerability causes the btmtksdio_txrx_work() function to enter an infinite loop, resulting in a hung task that blocks the SDIO host. This can lead to degraded Bluetooth functionality or system instability related to Bluetooth SDIO communication. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue has been identified and fixed in the Linux kernel source, so applying the latest kernel updates when available is recommended to resolve this infinite loop condition.