CVE-2026-58374: Hostapd Wi-Fi 7 Multi-Link Operation Out-of-Bounds Write DoS

Technical summary

CVE-2026-58374 is an out-of-bounds write vulnerability in hostapd's IEEE 802.11be (Wi-Fi 7) Multi-Link Operation (MLO) association request handler. The vulnerable function hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c fails to validate the link_id field from a received Per-STA Profile subelement within a Multi-Link Element. The specification permits link_id values 0–14, with the links[] array sized accordingly; however, the code permits parsing a link_id value of 15, resulting in an out-of-bounds write to links[15]. This memory corruption occurs prior to 4-way handshake validation, meaning no credentials are required. The flaw is reachable by any unauthenticated device transmitting a malformed management frame. Impact is denial of service; no memory disclosure or code execution has been demonstrated.

Business impact

Organizations deploying hostapd as an access point controller face service availability risk. A remote attacker can repeatedly crash the access point daemon, causing disconnection of all associated clients and potential service interruption. In enterprise environments, this could trigger cascading impacts on network-dependent systems. Critical access point infrastructure relying on hostapd (particularly early Wi-Fi 7 rollouts) should prioritize patching. The attack surface is wireless range, making it accessible from parking lots or adjacent buildings, with no prerequisites for exploitation.

Affected systems

Hostapd versions 2.11 and later development snapshots before v2.12, when compiled with CONFIG_IEEE80211BE enabled (Wi-Fi 7 support). This includes stable release v2.11.x and any intermediate development builds. The vulnerability does not affect hostapd v2.10.x or earlier, or builds without IEEE 802.11be support. Downstream distributions and custom builds must verify their hostapd version and compile-time configuration. Access point vendors embedding hostapd may have patched versions available; consult your vendor's security advisory for exact product models and firmware versions.

Exploitability

Exploitability is high from a practical standpoint. The attack requires only wireless range—no network association, credentials, or user interaction. An attacker can send a single crafted IEEE 802.11 management frame to trigger the vulnerability. However, impact is limited to denial of service (process crash); no privilege escalation, code execution, or information disclosure has been demonstrated. The vulnerability was not observed in CISA's Known Exploited Vulnerabilities catalog at publication time, but the simplicity of triggering a crash via a malformed frame means exploitation risk increases with visibility.

Remediation

Upgrade hostapd to version 2.12 or later, which includes the fix for the bounds-check vulnerability. Verify that your build includes the patch from the 2026-1 upstream fix series. For systems unable to immediately upgrade, the practical mitigation is to disable Wi-Fi 7 (IEEE 802.11be) support at build time or via configuration—rebuild hostapd without CONFIG_IEEE80211BE, or downgrade to v2.10.x if Wi-Fi 7 is not required. Network-level mitigation is infeasible; the attack originates from unauthenticated wireless range. Prioritize upgrades in environments where hostapd is publicly facing or connected to untrusted networks.

Patch guidance

Hostapd maintainers released the fix in v2.12, available from the official w1.fi repository. Verify your distribution or vendor has published a patched version. If applying patches directly to source, confirm that the bounds check on link_id in hostapd_process_ml_assoc_req() is present in your version tree. Test patched binaries in a staging environment, particularly if Wi-Fi 7 clients are expected. Coordinate with any downstream products (wireless appliances, router firmware) that embed hostapd—they may have a separate release schedule. The fix is straightforward and low-risk to deploy.

Detection guidance

Monitor hostapd process stability and restart frequency. A sudden increase in hostapd crashes or unexpected restarts may indicate attack attempts. Enable verbose logging in hostapd (debug level) to capture 802.11 frame processing errors around the time of crashes. Wireless intrusion detection systems (IDS) may flag malformed Multi-Link Elements in 802.11be association requests; correlate these alerts with hostapd stability metrics. Passive RF monitoring near the access point for unexplained 802.11be association attempts can provide defense-in-depth visibility. No simple signature-based detection is available without examining frame contents; focus on behavioral indicators (process termination patterns).

Why prioritize this

This vulnerability merits medium-to-high priority for environments deploying Wi-Fi 7 access points via hostapd. CVSS score (6.5) reflects the high availability impact (process crash) offset by limited scope (denial of service only). Prioritization should be elevated if: (1) your network has deployed Wi-Fi 7 clients or access points; (2) hostapd is exposed to untrusted wireless networks; (3) uptime SLAs are strict. Lower priority for v2.10.x deployments or environments without IEEE 802.11be support. Timeline: patch within 30 days for critical infrastructure, 60 days for others.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects: Attack Vector (Adjacent)—attacker must be within wireless range but not on the same network; Attack Complexity (Low)—no special conditions; Privileges Required (None)—no authentication needed; User Interaction (None)—no victim action required; Scope (Unchanged)—impact confined to the hostapd process itself; Confidentiality (None)—no data leakage; Integrity (None)—no unauthorized modification; Availability (High)—service interruption via process crash. The score appropriately captures availability risk while acknowledging the absence of privilege escalation or code execution.

Frequently asked questions