CVE-2026-58374: W1.fi Hostapd DoS Vulnerability

CVE-2026-58374 Overview

CVE-2026-58374 is an out-of-bounds write vulnerability in hostapd versions before 2.12 when built with CONFIG_IEEE80211BE enabled. The flaw resides in hostapd_process_ml_assoc_req() within src/ap/ieee802_11_eht.c, which handles Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association requests. An unauthenticated attacker within wireless range can send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. The malformed link_id value triggers memory corruption before the 4-way handshake completes. The confirmed impact is denial of service through hostapd process termination, disrupting all associated wireless clients.

Critical Impact
An unauthenticated adjacent attacker can terminate the hostapd access point process by sending a single malformed Wi-Fi 7 MLO management frame, causing wireless service disruption without any credentials or user interaction.

Affected Products

w1.fi hostapd v2.11 development snapshots
w1.fi hostapd development snapshots before v2.12
Any hostapd build with CONFIG_IEEE80211BE enabled

Discovery Timeline

2026-06-30 - CVE CVE-2026-58374 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58374

Vulnerability Analysis

The vulnerability is an off-by-one style out-of-bounds write [CWE-193] in the Wi-Fi 7 Multi-Link Operation (MLO) association handler. When a station sends an association request to an AP-mode hostapd instance, the function hostapd_process_ml_assoc_req() parses the Multi-Link Element and its Per-STA Profile subelements. The parser reads the link_id field from attacker-supplied frame data and uses it as an index into the internal links[] array. The array has valid entries for link IDs 0 through 14, but a link_id value of 15 passes parsing without a bounds check. Indexing beyond the array boundary produces a small memory corruption during pre-authentication processing.

Root Cause

The root cause is a missing bounds validation on the link_id field extracted from received MLO management frames. The IEEE 802.11be specification permits link_id values that exceed the actual storage capacity provisioned by hostapd. The code path executes before the 4-way handshake, so no cryptographic authentication or association state protects the vulnerable parser.

Attack Vector

An attacker within wireless range of an affected Wi-Fi 7 access point transmits a crafted 802.11 management frame with a malformed Multi-Link Element containing a Per-STA Profile subelement where link_id equals 15. The AP-mode hostapd process attempts to store per-link state at an out-of-bounds offset in links[]. The resulting memory corruption causes the process to terminate, dropping all wireless clients and disabling the SSID until hostapd is restarted. The attack requires no credentials, no prior association, and no user interaction.

Refer to the W1 Security Report 2026-1 for the full frame-level technical breakdown.

Detection Methods for CVE-2026-58374

Indicators of Compromise

Unexpected hostapd process crashes or restarts on Wi-Fi 7 access points, particularly during association attempts
System log entries showing SIGSEGV or abort signals originating from hostapd with recent MLO association activity
Sudden mass client disconnection events on an 802.11be-capable SSID without corresponding administrative action
Malformed Multi-Link Element frames captured in wireless traffic showing link_id values of 15 or other unexpected high values

Detection Strategies

Monitor hostapd service exit codes and core dumps via systemd journal, syslog, or process supervisors
Deploy wireless intrusion detection sensors capable of parsing 802.11be management frames and flagging non-conformant Multi-Link Element structures
Correlate access point unavailability events with adjacent wireless management frame captures to identify pre-authentication association traffic anomalies

Monitoring Recommendations

Forward hostapd stdout, stderr, and systemd status changes to a centralized logging platform for crash-loop detection
Alert on repeated hostapd restarts within short time windows on Wi-Fi 7 infrastructure
Track MLO association request volumes per client MAC address to identify anomalous scanning or fuzzing behavior

How to Mitigate CVE-2026-58374

Immediate Actions Required

Upgrade hostapd to v2.12 or later, which includes the upstream 2026-1 fixes
Apply the upstream patches referenced by commits 46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187 and aa9d345887389a251c63a3781d2ad2940d079193 if rebuilding from source
Inventory all Wi-Fi 7 access points and embedded devices shipping hostapd builds with CONFIG_IEEE80211BE enabled
Coordinate with hardware vendors for firmware updates on managed access points and OpenWRT-based deployments

Patch Information

The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes. See the Hostap Commit Update, Hostap Commit Patch, and the Openwall OSS Security Post for release details.

Workarounds

Rebuild hostapd with CONFIG_IEEE80211BE disabled if Wi-Fi 7 MLO functionality is not required, reverting affected APs to Wi-Fi 6/6E operation
Configure hostapd process supervision to automatically restart on crash to reduce service outage duration until patching completes
Restrict physical proximity access to sensitive Wi-Fi 7 deployments where feasible, since the attack requires adjacent network range

bash

# Configuration example: disable 802.11be at build time as a temporary workaround
# In hostapd/.config, comment out or remove:
# CONFIG_IEEE80211BE=y

# Then rebuild:
make clean
make

# Or, upgrade to patched version:
git clone git://w1.fi/hostap.git
cd hostap
git checkout hostap_2_12
cd hostapd
cp defconfig .config
make