[PATCH] AP: Disconnect station when PMKSA entry expires

[Jouni Malinen]

On Fri, May 15, 2026 at 10:44:28AM +0800, Jason Huang wrote:
> When a PMKSA cache entry expires for a currently associated station, the
> AP may keep the link up until another trigger causes reauthentication.
> This delays key refresh and can leave the station connected with stale
> PMKSA state.
> 
> Fix this by disconnecting the station when its PMKSA entry is freed on
> expiration. The disconnect causes the STA to immediately start a new
> authentication exchange and complete a fresh association/4-way handshake.

That seems reasonable for an associated STA, but the proposed changes
seem to make the AP transmit a Deauthentication frame regardless of
whether the STA is associated. That seems unexpected and undesired,
i.e., sending that frame should be conditional on there actually being
an associated STA.

> Also add plumbing for dot11RSNAConfigPMKLifetime into the authenticator
> context so the configured PMK lifetime is propagated to the lower layers.

That should be moved to a separate patch to keep things easier to
understand. It would also be good to document the new hostapd
configuration parameter in hostapd/hostapd.conf.

-- 
Jouni Malinen                                            PGP id EFC895FA