A race condition in the mwifiex driver for Linux kernels causes the driver to incorrectly switch the power‑save state back to awake while a roaming or association operation is still in flight. When this happens, the firmware never sends the expected sleep‑confirm command, leaving scan requests unresolved. Resulting scan operations never complete and any subsequent userspace scan requests fail with an EBUSY error. This leads to a persistent state where Wi‑Fi scans cannot finish, effectively denying the device from discovering or connecting to other networks until a reset or new firmware is loaded.

The vulnerability affects any Linux kernel build that includes the mwifiex Wi‑Fi driver, particularly on devices using Intel wireless firmware such as the IW412 and W8997 modules. No specific kernel version is listed, so the issue could be present in any kernel revision before the fix was merged into the mainline tree.

With a CVSS score of 5.5, this vulnerability is considered medium severity. The EPSS score of <1% indicates a low probability of exploitation. It is not listed in CISA KEV, so no evidence of active exploitation. The flaw seems to require interaction with the mwifiex driver during roaming or association, which could be triggered by normal user‑space Wi‑Fi commands and therefore is likely to be local or remotely triggered if an attacker can inject such commands. The denial of Wi‑Fi scans does not provide remote code execution or privilege escalation and is limited to the affected host.