From ce1a8612e309fe86133ecf05ffb452b0bdf3b035 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
Date: Mon, 18 May 2026 15:45:15 +0300
Subject: AP MLD: Verify AP MLD link ID validity before updating bitmap of
 links

Link ID is 0..14, so ignore value 15 if an invalid frame is processed.
It does not look like the invalid value was actually used to reference
any local array, but in any case, it is better to not mark an invalid
link as being specified.

Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
---
 src/ap/beacon.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/src/ap/beacon.c
+++ b/src/ap/beacon.c
@@ -1411,6 +1411,7 @@ static bool parse_ml_probe_req(const str
 	for_each_element_id(sub, 0, pos, len) {
 		const struct ieee80211_eht_per_sta_profile *sta;
 		u16 sta_control;
+		u8 link_id;
 
 		if (*links == 0xffff)
 			*links = 0;
@@ -1430,7 +1431,9 @@ static bool parse_ml_probe_req(const str
 		 * partial profile was requested.
 		 */
 		sta_control = le_to_host16(sta->sta_control);
-		*links |= BIT(sta_control & BASIC_MLE_STA_CTRL_LINK_ID_MASK);
+		link_id = sta_control & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
+		if (link_id < MAX_NUM_MLD_LINKS)
+			*links |= BIT(link_id);
 	}
 
 	if (!for_each_element_completed(sub, pos, len)) {
