hostapd CVE-2026-58374

The target AP must run hostapd 2.11 or a pre-2.12 development snapshot compiled with CONFIG_IEEE80211BE and operating as a Wi-Fi 7 (IEEE 802.11be) access point with Multi-Link Operation active - this build/deployment mode is the essential prerequisite, and non-Wi-Fi-7 or non-CONFIG_IEEE80211BE builds are not affected. Per CVSS PR:N/UI:N, no network credentials, prior authentication, or user interaction are required, and the malformed Multi-Link Element / Per-STA Profile frame is processed before the 4-way handshake. The key limiting factor is AV:A: the attacker must be within wireless radio range of the AP (not exploitable over the internet), and the vulnerable Wi-Fi 7 MLO configuration is still a relatively new, non-default deployment.

The signals are internally consistent and point to a real but bounded risk. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, 7.1 High) reflects adjacent (wireless-range) reach, no authentication, and a high-availability impact with no confidentiality loss - matching the confirmed practical impact of hostapd process termination. EPSS is low (0.29%, 20th percentile) and CISA's SSVC framework rates Exploitation: none, Automatable: no, Technical Impact: partial, and it is not on the KEV list, so there is no evidence of widespread active exploitation. The AV:A adjacency requirement (attacker must be in wireless radio range, cannot exploit remotely across the internet) is the primary limiting factor, and exploitation additionally requires the target to run a Wi-Fi 7 (802.11be) AP built with CONFIG_IEEE80211BE - a non-default, still-emerging configuration. This is a legitimate patch-worthy DoS for Wi-Fi 7 AP operators but not an internet-facing critical; while an out-of-bounds write theoretically raises the specter of code execution, the vendor and description characterize the confirmed impact as denial of service only.

An attacker within Wi-Fi radio range of a Wi-Fi 7 access point running vulnerable hostapd crafts a malformed 802.11be association request whose Multi-Link Element / Per-STA Profile subelement sets link_id to 15. When hostapd_process_ml_assoc_req() parses it, the out-of-bounds write corrupts memory and terminates the hostapd process, knocking the AP offline for all clients. No credentials, prior authentication, or user interaction are needed; no public exploit code has been identified at time of analysis.