Junglewise Threat Intelligence

CVE-2026-58374: hostapd and wpa_supplicant out-of-bounds write in Wi-Fi 7 MLO parsing

CVE-2026-58374 · Severity: medium · CVSS 6.5 · Published 2026-06-30

Executive brief

A vulnerability exists in the software responsible for managing Wi-Fi access points and client connections on many Linux-based systems. An attacker within wireless range can send a specially crafted Wi-Fi 7 management frame to crash the service, resulting in a denial of service. This attack does not require any passwords or prior authentication, potentially disrupting wireless connectivity for all users on the affected network.

Technical details

An off-by-one error exists in the parsing of Multi-Link Elements (MLE) within IEEE 802.11be (Wi-Fi 7) association requests. In hostapd_process_ml_assoc_req(), the link_id field is masked to a value between 0 and 15, but the internal links array only contains 15 entries (indices 0-14). A crafted frame with a link_id of 15 triggers an out-of-bounds write. This occurs during the association phase before the 4-way handshake, meaning no authentication or network credentials are required. The primary impact is a crash of the hostapd or wpa_supplicant process (Denial of Service). The issue is fixed in version 2.12 and via upstream patches in the 2026-1 security release.

Affected products

  • w1.fi hostapd v2.11 and newer development snapshots before v2.12
  • w1.fi wpa_supplicant v2.11 and newer development snapshots before v2.12

Timeline

  • 2026-05-14: other: Reported to upstream
  • 2026-06-05: advisory: Upstream security advisory published
  • 2026-06-30: disclosed: Public disclosure and CVE assignment

References