CVE-2026-58374

Name of the Vulnerable Software and Affected Versions hostapd versions 2.11 through 2.11

Description A missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In the function hostapd process ml assoc req(), the link id field can be parsed as value 15, while the links[] storage only contains valid entries for IDs 0 through 14. This results in an out-of-bounds write and small memory corruption during association processing before the 4-way handshake, leading to a denial of service through process termination. The issue specifically affects systems built with CONFIG IEEE80211BE enabled.

Recommendations Update to version 2.12.