CVE-2026-68469

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: fix permanently busy scans after multiple roam iterations

In order for the firmware to sleep, the driver has to confirm a

previously received sleep request. The normal sequence of evets goes

like this:

EVENT_SLEEP -> adapter->ps_state = PS_STATE_PRE_SLEEP -> sleep-confirm

-> SLEEP -> EVENT_AWAKE -> AWAKE.

Before sending the sleep-confirm command, the driver must make sure

there are no commands either running or waiting to be completed.

mwifiex_ret_802_11_associate() unconditionally sets

ps_state = PS_STATE_AWAKE when it processes the association command

response, outside of the normal powersave management flow. If

EVENT_SLEEP arrives while the association command is in flight,

ps_state is PRE_SLEEP when the association command response is parsed,

and the forced AWAKE overwrites it. The deferred sleep-confirm is

never sent.

A subsequent scan_start command is correctly acknowledged, but the

firmware do

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References