MITRE assigned CVE-2026-58374 with a CVSS score of 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

-- Abhinav

On Mon, Jun 29, 2026 at 7:50 PM Abhinav Agarwal <abhinavagarwal1996 () gmail com> wrote: A Wi-Fi 7 / IEEE 802.11be MLD parsing issue in hostapd AP mode has been fixed upstream:

https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt

Issue: Missing link ID validation in hostapdprocessmlassocreq() (src/ap/ieee80211eht.c). linkid is masked with 0x000f (values 0-15), but links[] only has valid entries 0..14 (MAXNUMMLDLINKS=15). A crafted Per-STA Profile with linkid=15 can write past the end of links[] during association processing.

This is reachable before the 4-way handshake; no credentials are required. An attacker within radio range can trigger it with a crafted association request.

Affected: hostapd v2.11 and newer repository snapshots before v2.12, built with CONFIGIEEE80211BE and running Wi-Fi 7 / MLD AP configuration.

Impact: hostapd process termination / denial of service, and small memory corruption, per the upstream advisory.

Fix: https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187

Additional related fixes are listed in the upstream advisory.

Mitigation: Update to hostapd v2.12 or newer once available, or apply the upstream fixes and rebuild.

CVE status: CVE assignment requested from MITRE under CAN-2026-2032030

Credit: The upstream advisory credits Sebastián Alba Vives, with independent discovery and report by Abhinav Agarwal.

Timeline: 2026-05-14 reported to upstream 2026-06-05 upstream published security advisory

-- Abhinav Agarwal

An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.

The implementations of SAE in hostapd and wpasupplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpasupplicant with SAE support prior to and including version 2.7 are affected.

An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpasupplicant with SAE support prior to and including version 2.7 are affected.

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

hostapd 0.6.7 through 2.5 and wpasupplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.

Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpasupplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.

The EAP-pwd peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message.

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.

Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpasupplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.

The WPS UPnP function in hostapd, when using WPS AP, and wpasupplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of service (crash) via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow.

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Jouni Malinen discovered that a string supplied from a remote device could be supplied to a system() call in wpacli or hostapdcli when running an action script (with the "-a" option), resulting in arbitrary command execution. This issue could also be triggered by an attacker within radio range.

Patches are available from the following:

http://w1.fi/security/2014-1/

Based on the information about affected configurations in the upstream advisory, Red Hat Enterprise Linux 5 is likely to be not vulnerable, but Red Hat Enterprise Linux 6 and 7 are likely to be vulnerable.

Acknowledgements:

Red Hat would like to thank Jouni Malinen for reporting this issue.

References:

http://w1.fi/security/2014-1/ http://www.openwall.com/lists/oss-security/2014/10/09/28

hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials.