[PATCH] AP: Fix MLD STA re-authentication with changed per-link address

[Johannes Berg]

On Mon, 2026-07-27 at 18:43 +0200, Jose Ignacio Tornos Martinez wrote:
> When an MLD STA reconnects after a firmware crash recovery, mac80211
> generates new random per-link addresses for the new connection. If
> the AP still has the STA entry from the previous connection, the
> authentication response is sent to the old per-link address which
> the STA does not ACK, preventing reconnection until the AP's
> inactivity timer (~300s) removes the stale entry.

Known issue, yeah, have you seen all the discussions with Benjamin and
others about this whole situation?

> For PMF-protected authorized stations, immediately deauthorize the
> STA and stop any running SA Query rather than starting a new SA Query
> procedure. SA Query is designed to verify whether the old STA is
> still reachable, but in this scenario it can never succeed: the SA
> Query is sent to the MLD address which the driver translates to the
> old per-link address that the STA no longer uses after its firmware
> restart. Waiting for the SA Query timeout (~5s) causes the STA to
> give up on that link and fall back to a different link, resulting in
> a single-link association instead of the expected multi-link setup.
> Skipping SA Query is safe because the full 4-Way Handshake that
> follows the authentication will verify the STA's credentials before
> any protected frames are exchanged.

Yeah but that means you can now abuse this to kick out any station, no?
Send a new authentication with a random link address and the station's
MLD address, and it gets dropped? So it's "safe" in the sense that
there's no data leak, but it's not good in the sense that actually
connected stations are kicked out? Or am I misunderstanding this
scenarios?

johannes