[PATCH] AP: Fix MLD STA re-authentication with changed per-link address

[Benjamin Berg]

On Mon, 2026-07-27 at 22:40 +0200, Johannes Berg wrote:
> On Mon, 2026-07-27 at 18:43 +0200, Jose Ignacio Tornos Martinez wrote:
> > When an MLD STA reconnects after a firmware crash recovery, mac80211
> > generates new random per-link addresses for the new connection. If
> > the AP still has the STA entry from the previous connection, the
> > authentication response is sent to the old per-link address which
> > the STA does not ACK, preventing reconnection until the AP's
> > inactivity timer (~300s) removes the stale entry.
> 
> Known issue, yeah, have you seen all the discussions with Benjamin and
> others about this whole situation?

A proper fix for these issues requires adding new nl80211 APIs. We have
a proposed kernel fix for this issue at
  https://lore.kernel.org/all/20260223123818.384184-10-benjamin@sipsolutions.net/
and hostapd will need to be adjusted accordingly.
Unfortunately, I have not yet seen any proposal on top of this to fix
the hostapd side. That said, I think the API should be fine so maybe we
should just move on and get it included in the kernel at this point.

There were some more detailed discussions before where we also had a
list of possible scenarios where the current code fails in the wild. No
matter what you do, without such a new API it is impossible to
correctly handle all of them.

Benjamin

> > For PMF-protected authorized stations, immediately deauthorize the
> > STA and stop any running SA Query rather than starting a new SA
> > Query
> > procedure. SA Query is designed to verify whether the old STA is
> > still reachable, but in this scenario it can never succeed: the SA
> > Query is sent to the MLD address which the driver translates to the
> > old per-link address that the STA no longer uses after its firmware
> > restart. Waiting for the SA Query timeout (~5s) causes the STA to
> > give up on that link and fall back to a different link, resulting
> > in
> > a single-link association instead of the expected multi-link setup.
> > Skipping SA Query is safe because the full 4-Way Handshake that
> > follows the authentication will verify the STA's credentials before
> > any protected frames are exchanged.
> 
> Yeah but that means you can now abuse this to kick out any station,
> no?
> Send a new authentication with a random link address and the
> station's
> MLD address, and it gets dropped? So it's "safe" in the sense that
> there's no data leak, but it's not good in the sense that actually
> connected stations are kicked out? Or am I misunderstanding this
> scenarios?
> 
> johannes
> 
> _______________________________________________
> Hostap mailing list
> Hostap at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/hostap