{"id":"CVE-2026-58374","aliases":["ALSA-2026:85276","ALSA-2026:85277","BELL-CVE-2026-58374","CLSA-2026-1784037722","DEBIAN-CVE-2026-58374","EUVD-2026-40306","GHSA-f38w-mwf7-vv8p","RHSA-2026:85276","RHSA-2026:85277","RLSA-2026:85276","RLSA-2026:85277","SUSE-SU-2026:22851-1","SUSE-SU-2026:22931-1","SUSE-SU-2026:23072-1","SUSE-SU-2026:3103-1","UBUNTU-CVE-2026-58374","openSUSE-SU-2026:11253-1","openSUSE-SU-2026:11278-1","openSUSE-SU-2026:21360-1","openSUSE-SU-2026:21415-1"],"status":"published","title":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link...","description":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00294,"percentile":0.22244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193"],"published":"2026-06-30T12:35:54Z","modified":"2026-10-29T11:32:38Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"hostapd","fixed_in":["2.11-3.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"hostapd","fixed_in":["2.11-3.el9_8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"hostapd","fixed_in":["2.11-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"hostapd-logwatch","fixed_in":["2.11-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"hostapd","fixed_in":["0:2.11-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"hostapd-debuginfo","fixed_in":["0:2.11-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"hostapd-debugsource","fixed_in":["0:2.11-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"hostapd","fixed_in":["0:2.11-3.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"hostapd-debuginfo","fixed_in":["0:2.11-3.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"hostapd-debugsource","fixed_in":["0:2.11-3.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"hostapd","fixed_in":["0:2.11-3.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"hostapd","fixed_in":["0:2.11-3.el9_8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"wpa_supplicant","fixed_in":["2.11-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"wpa_supplicant","fixed_in":["2.11-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"wpa_supplicant","fixed_in":["2.11-160000.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wpa_supplicant","fixed_in":["2.11-7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"hostapd","fixed_in":["2.11-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"hostapd","fixed_in":["2.11-bp160.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"wpa_supplicant","fixed_in":["2.11-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-3.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-3.el9_8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"hostapd-logwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"hostapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"hostapd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-3.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"hostapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-3.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"hostapd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-3.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-3.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-3.el9_8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-slfo.1.1_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-150700.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-bp160.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-160000.4.1"}]}]}],"products":[{"vendor":"jouni malinen","product":"hostapd"},{"vendor":"w1.fi","product":"hostapd"}],"references":[{"url":"https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt","tags":["vendor-advisory","Mitigation","Third Party Advisory","advisory","article","report"]},{"url":"https://w1.fi/security/2026-1/","tags":["vendor-advisory","patch","Issue Tracking","fix","article","report"]},{"url":"https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187","tags":["patch","Patch","fix","article","report"]},{"url":"https://git.w1.fi/cgit/hostap/commit/?id=aa9d345887389a251c63a3781d2ad2940d079193","tags":["patch","Patch","fix","article","report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/30/1","tags":["Mailing List","Mitigation","Patch","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58374","tags":["advisory"]},{"url":"https://w1.fi/security/2026-1"},{"url":"https://github.com/advisories/GHSA-f38w-mwf7-vv8p"},{"url":"https://access.redhat.com/errata/RHSA-2026:85276","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58374","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494924","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-85276.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85277","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-85277.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-58374","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784037722.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58374.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-58374","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494924","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85276.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58374","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85277.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85276","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85277","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622851-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258365","tags":["report"]},{"url":"https://bugzilla.suse.com/1269892","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58374","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622931-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623072-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230797","tags":["report"]},{"url":"https://bugzilla.suse.com/1239461","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24912","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263103-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-58374","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-58374","description":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.","status":"published","published":"2026-06-30T12:35:54.44Z","modified":"2026-06-30T13:38:26.434Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-40306","description":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.","status":"published","published":"2026-06-30T12:35:54Z","modified":"2026-06-30T13:38:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:21.627235Z"}],"ghsa":[{"id":"GHSA-f38w-mwf7-vv8p","title":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link...","description":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.","status":"published","published":"2026-06-30T15:30:45Z","modified":"2026-06-30T15:30:56Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:09:05.934873Z"}],"nvd":[{"id":"CVE-2026-58374","description":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.","status":"published","published":"2026-06-30T13:19:18.96Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"BELL-CVE-2026-58374","title":"CVE-2026-58374 does not affect BellSoft software","status":"withdrawn","published":"2026-07-04T06:04:35.2816Z","modified":"2026-07-17T07:15:10.65784763Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-58374","description":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.","status":"published","published":"2026-06-30T12:35:54.44Z","modified":"2026-10-28T02:30:49.247854215Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-58374","description":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.","status":"withdrawn","published":"2026-06-30T13:19:18.96Z","modified":"2026-07-02T02:01:31.672288128Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"RHSA-2026:85276","title":"Red Hat Security Advisory: hostapd security update","status":"published","published":"2026-10-20T10:18:05Z","modified":"2026-10-20T10:31:43.072603829Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85277","title":"Red Hat Security Advisory: hostapd security update","status":"published","published":"2026-10-20T10:18:05Z","modified":"2026-10-20T10:32:25.269447494Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:85276","title":"Moderate: hostapd security update","description":"hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server.  hostapd is designed to be a \"daemon\" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd.\n\nSecurity Fix(es):\n\n* hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-21T12:08:03.04509Z","modified":"2026-10-21T12:30:03.293235006Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:85277","title":"Moderate: hostapd security update","description":"hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server.  hostapd is designed to be a \"daemon\" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd.\n\nSecurity Fix(es):\n\n* hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-21T06:40:27.160172Z","modified":"2026-10-21T07:15:07.931572909Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-58374","description":"In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.","status":"withdrawn","published":"2026-06-30T13:19:00Z","modified":"2026-07-07T21:03:50.301864526Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:85276","title":"Moderate: hostapd security update","description":"hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a \"daemon\" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd.  \n\nSecurity Fix(es):  \n\n  * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:31:00.43459749Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:85277","title":"Moderate: hostapd security update","description":"hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a \"daemon\" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd.  \n\nSecurity Fix(es):  \n\n  * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:32:38.214341691Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1784037722","title":"hostapd: Fix of CVE-2026-58374","description":"- CVE-2026-58374: reject invalid MLO Link ID (\u003e= MAX_NUM_MLD_LINKS) in\n  Per-STA Profile parsing to prevent an out-of-bounds write","status":"published","published":"2026-07-14T14:02:19Z","modified":"2026-10-26T09:31:16.591652292Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"openSUSE-SU-2026:11253-1","title":"wpa_supplicant-2.11-7.1 on GA media","description":"These are all security issues fixed in the wpa_supplicant-2.11-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-10T00:00:00Z","modified":"2026-07-11T09:15:06.215804782Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11278-1","title":"hostapd-2.11-4.1 on GA media","description":"These are all security issues fixed in the hostapd-2.11-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-15T00:00:00Z","modified":"2026-07-16T10:00:17.630691656Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21360-1","title":"Security update for hostapd","description":"This update for hostapd fixes the following issues:\n\nChanges in hostapd:\n\n- CVE-2026-58374: Missing multi-link parsing validation in wpa_supplicant and hostapd (bsc#1269892)\n","status":"published","published":"2026-07-15T16:44:40Z","modified":"2026-07-17T18:24:06.790752031Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21415-1","title":"Security update for wpa_supplicant","description":"This update for wpa_supplicant fixes the following issues\n\n- CVE-2026-58374: Fixed a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) MLO association request processing allows an\n  unauthenticated user to send a crafted management frame and cause an out-of-bounds write (bsc#1269892).\n","status":"published","published":"2026-07-22T12:39:34Z","modified":"2026-07-24T18:24:26.716396744Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22851-1","title":"Security update for wpa_supplicant","description":"This update for wpa_supplicant fixes the following issues\n\n- CVE-2026-58374: Fixed a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) MLO association request processing allows an\n  unauthenticated user to send a crafted management frame and cause an out-of-bounds write (bsc#1269892).\n","status":"published","published":"2026-07-22T12:39:15Z","modified":"2026-07-28T18:24:10.523434376Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22931-1","title":"Security update for wpa_supplicant","description":"This update for wpa_supplicant fixes the following issues\n\n- CVE-2026-58374: Fixed a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) MLO association request processing allows an\n  unauthenticated user to send a crafted management frame and cause an out-of-bounds write (bsc#1269892).\n","status":"published","published":"2026-07-22T12:39:15Z","modified":"2026-07-29T18:24:20.872830627Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23072-1","title":"Security update for wpa_supplicant","description":"This update for wpa_supplicant fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-24912: RADIUS pending request dropping (bsc#1239461).\n- CVE-2026-58374: missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) MLO association request processing allows an\n  unauthenticated user to send a crafted management frame and cause an out-of-bounds write (bsc#1269892).\n- Missing network context validation for PMKSA caching https://w1.fi/security/2026-2/.\n- Unexpected SAE commit message contents terminating `wpa_supplicant` https://w1.fi/security/2026-3/.\n\nOther updates and bugfixes:\n\n- Revert \"Mark authorization completed on driver indication during 4-way HS offload\" because of WPA2-PSK/WPA-SAE\n  connection problems with brcmfmac wifi hardware (bsc#1230797).\n","status":"published","published":"2026-07-31T09:06:58Z","modified":"2026-08-14T18:23:35.611775961Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3103-1","title":"Security update for wpa_supplicant","description":"This update for wpa_supplicant fixes the following issues:\n\n- CVE-2025-24912: hostapd RADIUS authentication of wi-fi devices allows a user in between the hostapd and the RADIUS\n  server to inject crafted RADIUS packets and force RADIUS authentications to fail (bsc#1239461).\n- CVE-2026-58374: missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) MLO association request processing allows an\n  unauthenticated user to send a crafted management frame and cause an out-of-bounds write (bsc#1269892).\n- Missing network context validation for PMKSA caching https://w1.fi/security/2026-2/\n- Unexpected SAE commit message contents terminating `wpa_supplicant` https://w1.fi/security/2026-3/   \n","status":"published","published":"2026-07-17T13:30:04Z","modified":"2026-07-18T08:45:09.736248269Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}