CVE-2026-80936

A flaw was found in the Linux kernel's mt7925 Wi-Fi driver. During multi-link power-save setup, the mlopmwork is queued with a delay but not properly cancelled when the device is stopped. This can lead to the work item attempting to access a deallocated workqueue, resulting in a kernel warning an...

CVE-2026-80936

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlopmwork on stop mt7925 queues mlopmwork with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives...

CVE-2026-80936

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlopmwork on stop mt7925 queues mlopmwork with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives...

CVE-2026-64515

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This vulnerability arises from incorrect handling of Multi-Link Element MLE defragmentation. When a reconf or EPCS Enhanced Power Save MLE is present in a non-transmitted profile, the defragmentation routine uses an incorrect pointe...

SUSE CVE-2026-64515

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...

CVE-2026-64515

In the Linux kernel’s wifi/mac80211 stack, CVE-2026-64515 describes a defect in MLE (Multi-Link Element) defragmentation. When reconf or EPCS MLE is present in a non-transmitted profile, the defragmentation routine is invoked with a pointer to the defragmented copy but the original elements, caus...

CVE-2026-64515 wifi: mac80211: fix MLE defragmentation

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...

PT-2026-64736

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mac80211 wifi component regarding Multi-Link Element MLE defragmentation. When a reconf or EPCS MLE is located in a non-transmitted profile, the defragmentation...

OPENSUSE-SU-2026:21360-1 Security update for hostapd

This update for hostapd fixes the following issues: Changes in hostapd: - CVE-2026-58374: Missing multi-link parsing validation in wpasupplicant and hostapd bsc1269892...

CVE-2026-58374

A flaw was found in hostapd. An unauthenticated attacker within wireless range can send a specially crafted management frame during Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing. This crafted frame, containing a malformed Multi-Link Element or Per-STA Profile...

SUSE CVE-2026-58374

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile...

UBUNTU-CVE-2026-58374

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile...

CVE-2026-58374

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile...

EUVD-2026-40306

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile...

CVE-2026-58374

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile...

CVE-2026-58374

CVE-2026-58374 describes a bounds-check vulnerability in hostapd (before 2.12) where an MLO association request can cause an out-of-bounds write due to parsing a link_id value of 15, while the storage only supports IDs 0–14. This unauthenticated, range-limited attacker could trigger a denial of s...

CVE-2026-58374

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile...

CVE-2026-58374

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile...

CVE-2026-58374

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile...

kernel: wifi: mac80211: remove station if connection prep fails

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. When Multi-Link Operation MLO connection preparation fails, the system may not correctly remove the associated station. This can lead to a use-after-free or double-free vulnerability in the debugfs component, potentially causing...