CVE-2026-68469 - Vulnerability Details

- wifi: mwifiex: fix permanently busy scans after multiple roam iterations

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: fix permanently busy scans after multiple roam iterations

In order for the firmware to sleep, the driver has to confirm a
previously received sleep request. The normal sequence of evets goes
like this:
EVENT_SLEEP -> adapter->ps_state = PS_STATE_PRE_SLEEP -> sleep-confirm
-> SLEEP -> EVENT_AWAKE -> AWAKE.
Before sending the sleep-confirm command, the driver must make sure
there are no commands either running or waiting to be completed.

mwifiex_ret_802_11_associate() unconditionally sets
ps_state = PS_STATE_AWAKE when it processes the association command
response, outside of the normal powersave management flow. If
EVENT_SLEEP arrives while the association command is in flight,
ps_state is PRE_SLEEP when the association command response is parsed,
and the forced AWAKE overwrites it. The deferred sleep-confirm is
never sent.

A subsequent scan_start command is correctly acknowledged, but the
firmware doesn't generate scan_result events. The scan request never
finishes, and additional requests from userspace fail with -EBUSY.

After testing on both IW412 and W8997, I could only trigger the bug on
the IW412 and observed the firmwares behave differently. On the IW412
the firmware still sends EVENT_SLEEP while the authentication /
association process is ongoing. A W8997 under the same
conditions seems to suppress power-save for the duration of the
association, so PRE_SLEEP never coincided with the association response
even after extended periods of testing using the loops
described below (>12hours).

On the IW412, the delay between commands that triggers an EVENT_SLEEP
was empirically determined to be ~20ms. This delay can naturally occur
when the driver is outputting debugging information
(debug_mask = 0x00000037), in which situation the busy scans issue is
repeatable while running "test 1)" as described below. If the delay
between commands is less than ~20ms, the firmware stays awake and
the issue was not reproducible running the same test.

The host_mlme=false path also behaves differently. In this case, the
entire authentication / association transaction is executed by one
command (HostCmd_CMD_802_11_ASSOCIATE), and the firmware doesn't emit
EVENT_SLEEP while the command is running.

Remove the assignment so the ps_state is only manipulated in the paths
that are related to powersave event handling and on the main workqueue
for correct sleep confirmation.

The following loop tests were performed (with debugging output enabled):
1) force roaming between two AP's, one 5GHz and one 2.4GHz, same
SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s
between iterations.
2) force a disconnection to AP 1 and a connection to AP 2, test
scan. Use wpa_cli to trigger the connection changes, sleep 2s
between iterations.

Each test ran in each device for at least 3 hours.

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the mwifiex driver for Linux kernels causes the driver to incorrectly switch the power‑save state back to awake while a roaming or association operation is still in flight. When this happens, the firmware never sends the expected sleep‑confirm command, leaving scan requests unresolved. Resulting scan operations never complete and any subsequent userspace scan requests fail with an EBUSY error. This leads to a persistent state where Wi‑Fi scans cannot finish, effectively denying the device from discovering or connecting to other networks until a reset or new firmware is loaded.

Affected Systems

The vulnerability affects any Linux kernel build that includes the mwifiex Wi‑Fi driver, particularly on devices using Intel wireless firmware such as the IW412 and W8997 modules. No specific kernel version is listed, so the issue could be present in any kernel revision before the fix was merged into the mainline tree.

Risk and Exploitability

No CVSS score is provided and the EPSS score is unavailable; the vulnerability is not in the CISA KEV catalog. The attack surface appears to be local or remotely triggered via crafted roaming or association sequences. While the fault can cause a denial of Wi‑Fi scanning on the affected host, it does not provide remote code execution or privilege escalation, and no widespread exploitation has been reported. The risk is therefore moderate, limited to device availability and user experience rather than broader network compromise.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 2ed36b2586f16c480ed58de303af704c2235e16d
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 5796eabe435d83544b6fe39851ce47ca68fdb778
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 31a2c409f8f58d20f0f6391c151421155768ed77
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< deb5f0ae384f1cf41fccaf6375266db2f2911b2b
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 1bc55db2d34756bd53e4460dbb699619ee13cd7f
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< a59cfa165aee3e29d06145041c0ebe46a51de604
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 6126e12bf8c87badeab41a164c9689ac88e5c160
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< d78a407bad6f500884a8606aea1a5a9207be4030

Linux

affected

Version	Status	Constraints
`3.0`	affected	—
`0`	unaffected	< 3.0
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc4`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,2ed36b2586f16c480ed58de303af704c2235e16d)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,5796eabe435d83544b6fe39851ce47ca68fdb778)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,31a2c409f8f58d20f0f6391c151421155768ed77)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,deb5f0ae384f1cf41fccaf6375266db2f2911b2b)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,1bc55db2d34756bd53e4460dbb699619ee13cd7f)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,a59cfa165aee3e29d06145041c0ebe46a51de604)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,6126e12bf8c87badeab41a164c9689ac88e5c160)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,d78a407bad6f500884a8606aea1a5a9207be4030)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.0`	affected	semver	—
`[0,3.0)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc4,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the mwifiex patch (see the kernel commit links provided).
If an immediate kernel update is not possible, disable Wi‑Fi power‑saving or roaming features via driver options (for example, set `iwpriv <iface> sleep=0` or `iwconfig <iface> roam=off`).
Turn off verbose debugging output on the host, as the delay introduced by logging can expose the race condition. Ensure the device is rebooted after applying any configuration changes.

Generated by OpenCVE AI on August 15, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00212.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1bc55db2d34756bd53e4460dbb699619ee13cd7f
https://git.kernel.org/stable/c/2ed36b2586f16c480ed58de303af704c2235e16d
https://git.kernel.org/stable/c/31a2c409f8f58d20f0f6391c151421155768ed77
https://git.kernel.org/stable/c/5796eabe435d83544b6fe39851ce47ca68fdb778
https://git.kernel.org/stable/c/6126e12bf8c87badeab41a164c9689ac88e5c160
https://git.kernel.org/stable/c/a59cfa165aee3e29d06145041c0ebe46a51de604
https://git.kernel.org/stable/c/d78a407bad6f500884a8606aea1a5a9207be4030
https://git.kernel.org/stable/c/deb5f0ae384f1cf41fccaf6375266db2f2911b2b

History

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENT_SLEEP -> adapter->ps_state = PS_STATE_PRE_SLEEP -> sleep-confirm -> SLEEP -> EVENT_AWAKE -> AWAKE. Before sending the sleep-confirm command, the driver must make sure there are no commands either running or waiting to be completed. mwifiex_ret_802_11_associate() unconditionally sets ps_state = PS_STATE_AWAKE when it processes the association command response, outside of the normal powersave management flow. If EVENT_SLEEP arrives while the association command is in flight, ps_state is PRE_SLEEP when the association command response is parsed, and the forced AWAKE overwrites it. The deferred sleep-confirm is never sent. A subsequent scan_start command is correctly acknowledged, but the firmware doesn't generate scan_result events. The scan request never finishes, and additional requests from userspace fail with -EBUSY. After testing on both IW412 and W8997, I could only trigger the bug on the IW412 and observed the firmwares behave differently. On the IW412 the firmware still sends EVENT_SLEEP while the authentication / association process is ongoing. A W8997 under the same conditions seems to suppress power-save for the duration of the association, so PRE_SLEEP never coincided with the association response even after extended periods of testing using the loops described below (>12hours). On the IW412, the delay between commands that triggers an EVENT_SLEEP was empirically determined to be ~20ms. This delay can naturally occur when the driver is outputting debugging information (debug_mask = 0x00000037), in which situation the busy scans issue is repeatable while running "test 1)" as described below. If the delay between commands is less than ~20ms, the firmware stays awake and the issue was not reproducible running the same test. The host_mlme=false path also behaves differently. In this case, the entire authentication / association transaction is executed by one command (HostCmd_CMD_802_11_ASSOCIATE), and the firmware doesn't emit EVENT_SLEEP while the command is running. Remove the assignment so the ps_state is only manipulated in the paths that are related to powersave event handling and on the main workqueue for correct sleep confirmation. The following loop tests were performed (with debugging output enabled): 1) force roaming between two AP's, one 5GHz and one 2.4GHz, same SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s between iterations. 2) force a disconnection to AP 1 and a connection to AP 2, test scan. Use wpa_cli to trigger the connection changes, sleep 2s between iterations. Each test ran in each device for at least 3 hours.
Title		wifi: mwifiex: fix permanently busy scans after multiple roam iterations
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1bc55db2d34756bd53e4460dbb699619ee13cd7f https://git.kernel.org/stable/c/2ed36b2586f16c480ed58de303af704c2235e16d https://git.kernel.org/stable/c/31a2c409f8f58d20f0f6391c151421155768ed77 https://git.kernel.org/stable/c/5796eabe435d83544b6fe39851ce47ca68fdb778 https://git.kernel.org/stable/c/6126e12bf8c87badeab41a164c9689ac88e5c160 https://git.kernel.org/stable/c/a59cfa165aee3e29d06145041c0ebe46a51de604 https://git.kernel.org/stable/c/d78a407bad6f500884a8606aea1a5a9207be4030 https://git.kernel.org/stable/c/deb5f0ae384f1cf41fccaf6375266db2f2911b2b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:51:27.429Z

Updated: 2026-08-15T05:51:27.429Z

Reserved: 2026-07-30T09:28:09.396Z

Link: CVE-2026-68469

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:19:57.620

Modified: 2026-08-15T06:19:57.620

Link: CVE-2026-68469

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T09:00:06Z

Weaknesses

No weakness.

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object