Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hostapd for openSUSE:Factory checked in at 2026-07-15 16:53:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hostapd (Old) and /work/SRC/openSUSE:Factory/.hostapd.new.1991 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hostapd" Wed Jul 15 16:53:56 2026 rev:51 rq:1365905 version:2.11 Changes: -------- --- /work/SRC/openSUSE:Factory/hostapd/hostapd.changes 2026-06-12 19:29:43.231677279 +0200 +++ /work/SRC/openSUSE:Factory/.hostapd.new.1991/hostapd.changes 2026-07-15 17:11:23.347095499 +0200 @@ -1,0 +2,10 @@ +Wed Jul 15 07:18:44 UTC 2026 - Clemens Famulla-Conrad <[email protected]> + +- Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch + https://w1.fi/security/2026-2/ +- Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch + https://w1.fi/security/2026-3/ +- Add CVE-2026-58374.patch: Missing multi-link parsing validation in + wpa_supplicant and hostapd (bsc#1269892) + +------------------------------------------------------------------- New: ---- CVE-2026-58374.patch Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch ----------(New B)---------- New: https://w1.fi/security/2026-3/ - Add CVE-2026-58374.patch: Missing multi-link parsing validation in wpa_supplicant and hostapd (bsc#1269892) New: - Add Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch https://w1.fi/security/2026-2/ New: https://w1.fi/security/2026-2/ - Add SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch https://w1.fi/security/2026-3/ ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ hostapd.spec ++++++ --- /var/tmp/diff_new_pack.zJIS1g/_old 2026-07-15 17:11:24.019118405 +0200 +++ /var/tmp/diff_new_pack.zJIS1g/_new 2026-07-15 17:11:24.019118405 +0200 @@ -35,6 +35,12 @@ Patch1: CVE-2025-24912.patch # PATCH-FIX-UPSTREAM bsc#1268083 hostapd segmentation fault during fast restart cycles Patch2: nl80211_NULL_pointer_check_for_link.patch +# PATCH-FIX-UPSTREAM CVE-2026-58374, bsc#1269892 Missing multi-link parsing validation +Patch3: CVE-2026-58374.patch +# PATCH-FIX-UPSTREAM https://w1.fi/security/2026-2/ +Patch4: Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch +# PATCH-FIX-UPSTREAM https://w1.fi/security/2026-3/ +Patch5: SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch BuildRequires: libnl3-devel BuildRequires: openssl-devel BuildRequires: pkgconfig ++++++ CVE-2026-58374.patch ++++++ >From c8953f931f62f400a616a4a451c186ab0419e9e4 Mon Sep 17 00:00:00 2001 From: Clemens Famulla-Conrad <[email protected]> Date: Tue, 14 Jul 2026 15:45:45 +0200 Subject: [PATCH] CVE-2026-58374 Missing multi-link parsing validation Combined patch for CVE-2026-58374 bsc#1269892 https://w1.fi/security/2026-1/ https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187 AP MLD: Fix link ID validation in Basic MLE parsing https://git.w1.fi/cgit/hostap/commit/?id=ce1a8612e309fe86133ecf05ffb452b0bdf3b035 AP MLD: Verify AP MLD link ID validity before updating bitmap of links --- src/ap/beacon.c | 5 ++++- src/ap/ieee802_11_eht.c | 10 ++++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) --- a/src/ap/beacon.c +++ b/src/ap/beacon.c @@ -1305,6 +1305,7 @@ for_each_element_id(sub, 0, pos, len) { const struct ieee80211_eht_per_sta_profile *sta; u16 sta_control; + u8 link_id; if (*links == 0xffff) *links = 0; @@ -1324,7 +1325,9 @@ * partial profile was requested. */ sta_control = le_to_host16(sta->sta_control); - *links |= BIT(sta_control & EHT_PER_STA_CTRL_LINK_ID_MSK); + link_id = sta_control & BASIC_MLE_STA_CTRL_LINK_ID_MASK; + if (link_id < MAX_NUM_MLD_LINKS) + *links |= BIT(link_id); } if (!for_each_element_completed(sub, pos, len)) { --- a/src/ap/ieee802_11_eht.c +++ b/src/ap/ieee802_11_eht.c @@ -1262,6 +1262,7 @@ size_t sub_elem_len = *(pos + 1); size_t sta_info_len; u16 control; + u8 link_id; wpa_printf(MSG_DEBUG, "MLD: sub element len=%zu", sub_elem_len); @@ -1302,8 +1303,13 @@ goto out; } control = WPA_GET_LE16(pos); - link_info = &info->links[control & - EHT_PER_STA_CTRL_LINK_ID_MSK]; + link_id = control & BASIC_MLE_STA_CTRL_LINK_ID_MASK; + if (link_id >= MAX_NUM_MLD_LINKS) { + wpa_printf(MSG_DEBUG, + "MLD: Invalid Link ID in Per-STA Profile subelement"); + goto out; + } + link_info = &info->links[link_id]; pos += 2; ml_len -= 2; sub_elem_len -= 2; ++++++ Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch ++++++ >From de5e73a03c34d83568afb3183b2b28c8d7641a30 Mon Sep 17 00:00:00 2001 From: Jouni Malinen <[email protected]> Date: Mon, 6 Jul 2026 15:33:11 +0300 Subject: [PATCH] Require network_ctx and AKMP match for accepting PMKSA entry When wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID indicated by the AP/Authenticator, a PMKSA for the same AA was accepted without enforcing matching network_ctx (i.e., same network configuration block) and AKMP. This could allow misbehaving APs to make wpa_supplicant use an unacceptable PMKSA entry that was generated for a different network for AKMP under certain conditions. This could result in showing a connection to an incorrect network when an attacker has credentials to one network in wpa_supplicant configuration, but not to another network. Fix this by accepting the PMKID to set the PMKSA for an association only if the PMKSA with the same PMKID is for the same network and was generated using the same AKMP. Signed-off-by: Jouni Malinen <[email protected]> --- src/rsn_supp/wpa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/src/rsn_supp/wpa.c +++ b/src/rsn_supp/wpa.c @@ -321,7 +321,7 @@ * matching PMKSA cache entry here. */ sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, sm->own_addr, pmkid, - NULL, 0); + sm->network_ctx, sm->key_mgmt); if (sm->cur_pmksa) { wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "RSN: found matching PMKID from PMKSA cache"); ++++++ SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch ++++++ >From f12d55ff652ab2e367425c1392510d10d8b9f638 Mon Sep 17 00:00:00 2001 From: Jimi Chen <[email protected]> Date: Thu, 21 May 2026 06:56:54 +0000 Subject: [PATCH] SAE: Fix crash due to NULL pointer dereference in H2E parsing In H2E (Hash-to-Element) mode, sae_parse_commit() parses the optional Anti-Clogging Token Container by calling sae_parse_token_container(). However, callers of sae_parse_commit() that do not require retrieving the anti-clogging token (such as PASN initiator/responder and SME auth) pass NULL for the token and token_len output arguments. If the peer sends a Commit frame containing a valid Anti-Clogging Token Container element, sae_parse_token_container() unconditionally sets *token and *token_len, resulting in a NULL pointer dereference (SIGSEGV) and crashing wpa_supplicant. Fix this by adding NULL checks before writing to token and token_len. Update the debug log to print the token directly using 'pos'. Fixes: 5e32fb0170f4 ("SAE: Use Anti-Clogging Token Container element with H2E") Signed-off-by: Amarnath Hullur Subramanyam <[email protected]> --- src/common/sae.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/src/common/sae.c +++ b/src/common/sae.c @@ -1881,10 +1881,12 @@ pos, end - pos); if (!sae_is_token_container_elem(pos, end)) return; - *token = pos + 3; - *token_len = pos[1] - 1; + if (token) + *token = pos + 3; + if (token_len) + *token_len = pos[1] - 1; wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token (in container)", - *token, *token_len); + pos + 3, pos[1] - 1); }
