Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-68469— wifi: mwifiex: fix permanently busy scans after multiple roam iterations

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 3.0版本存在安全漏洞，该漏洞源于mwifiex驱动在处理关联命令响应时无条件将ps_state设置为PS_STATE_AWAKE，导致电源管理流程中的睡眠确认无法发送，可能造成永久忙扫描，使用户空间扫描请求失败。

AI Predicted 5.3 Difficulty: Moderate EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e< 2ed36b2586f16c480ed58de303af704c2235e16d affected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e< 5796eabe435d83544b6fe39851ce47ca68fdb778 affected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e< 31a2c409f8f58d20f0f6391c151421155768ed77 affected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e< deb5f0ae384f1cf41fccaf6375266db2f2911b2b affected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e< 1bc55db2d34756bd53e4460dbb699619ee13cd7f affected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e< a59cfa165aee3e29d06145041c0ebe46a51de604 affected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e< 6126e12bf8c87badeab41a164c9689ac88e5c160 affected
5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e< d78a407bad6f500884a8606aea1a5a9207be4030 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-68469

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: mwifiex: fix permanently busy scans after multiple roam iterations
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENT_SLEEP -> adapter->ps_state = PS_STATE_PRE_SLEEP -> sleep-confirm -> SLEEP -> EVENT_AWAKE -> AWAKE. Before sending the sleep-confirm command, the driver must make sure there are no commands either running or waiting to be completed. mwifiex_ret_802_11_associate() unconditionally sets ps_state = PS_STATE_AWAKE when it processes the association command response, outside of the normal powersave management flow. If EVENT_SLEEP arrives while the association command is in flight, ps_state is PRE_SLEEP when the association command response is parsed, and the forced AWAKE overwrites it. The deferred sleep-confirm is never sent. A subsequent scan_start command is correctly acknowledged, but the firmware doesn't generate scan_result events. The scan request never finishes, and additional requests from userspace fail with -EBUSY. After testing on both IW412 and W8997, I could only trigger the bug on the IW412 and observed the firmwares behave differently. On the IW412 the firmware still sends EVENT_SLEEP while the authentication / association process is ongoing. A W8997 under the same conditions seems to suppress power-save for the duration of the association, so PRE_SLEEP never coincided with the association response even after extended periods of testing using the loops described below (>12hours). On the IW412, the delay between commands that triggers an EVENT_SLEEP was empirically determined to be ~20ms. This delay can naturally occur when the driver is outputting debugging information (debug_mask = 0x00000037), in which situation the busy scans issue is repeatable while running "test 1)" as described below. If the delay between commands is less than ~20ms, the firmware stays awake and the issue was not reproducible running the same test. The host_mlme=false path also behaves differently. In this case, the entire authentication / association transaction is executed by one command (HostCmd_CMD_802_11_ASSOCIATE), and the firmware doesn't emit EVENT_SLEEP while the command is running. Remove the assignment so the ps_state is only manipulated in the paths that are related to powersave event handling and on the main workqueue for correct sleep confirmation. The following loop tests were performed (with debugging output enabled): 1) force roaming between two AP's, one 5GHz and one 2.4GHz, same SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s between iterations. 2) force a disconnection to AP 1 and a connection to AP 2, test scan. Use wpa_cli to trigger the connection changes, sleep 2s between iterations. Each test ran in each device for at least 3 hours.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 3.0版本存在安全漏洞，该漏洞源于mwifiex驱动在处理关联命令响应时无条件将ps_state设置为PS_STATE_AWAKE，导致电源管理流程中的睡眠确认无法发送，可能造成永久忙扫描，使用户空间扫描请求失败。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e ~ 2ed36b2586f16c480ed58de303af704c2235e16d -
Linux Linux 3.0 -

II. Public POCs for CVE-2026-68469

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68469

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-68469 (8)

Same Patch Batch · Linux · 2026-08-15 · 845 CVEs total

CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72217 9.8 CRITICAL SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
CVE-2026-72491 9.8 CRITICAL net/9p: fix race condition on rdma->state in trans_rdma.c
CVE-2026-72221 9.8 CRITICAL sunrpc: wait for in-flight TLS handshake callback when cancel loses race
CVE-2026-72222 9.8 CRITICAL sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
CVE-2026-72220 9.8 CRITICAL sunrpc: harden rq_procinfo lifecycle to prevent double-free
CVE-2026-72398 9.8 CRITICAL sctp: add INIT verification after cookie unpacking
CVE-2026-72477 9.8 CRITICAL fs/ntfs3: call _ntfs_bad_inode() when failing to rename
CVE-2026-72466 9.8 CRITICAL xprtrdma: Fix bcall rep leak and unbounded peek
CVE-2026-72472 9.8 CRITICAL nfs: use nfsi->rwsem to protect traversal of the file lock list
CVE-2026-72473 9.8 CRITICAL xprtrdma: Decouple req recycling from RPC completion
CVE-2026-72399 9.8 CRITICAL net: enetc: check the number of BDs needed for xdp_frame
CVE-2026-74398 9.8 CRITICAL ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

Showing top 20 of 845 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-68469

No comments yet

Leave a comment