From 56216d113909650ae59621dc2dd16157afb94948 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
Date: Mon, 18 May 2026 11:57:02 +0300
Subject: Verify MLD link ID validity in get_basic_mle_link_id()

Link ID is 0..14, so ignore value 15 if an invalid frame is processed.
It does not look like the returned value was actually used to reference
any local array, but in any case, it is better to not return an invalid
value to reduce risk for unexpected behavior in the future.

Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
---
 src/common/ieee802_11_common.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/src/common/ieee802_11_common.c
+++ b/src/common/ieee802_11_common.c
@@ -3714,6 +3714,7 @@ int get_basic_mle_link_id(const u8 *buf,
 		ETH_ALEN; /* MLD MAC Address field (Basic) */
 	size_t common_info_limit;
 	u8 common_info_len;
+	u8 link_id;
 
 	if (len < MULTI_LINK_CONTROL_LEN)
 		return -1;
@@ -3735,7 +3736,11 @@ int get_basic_mle_link_id(const u8 *buf,
 	if (link_id_pos + EHT_ML_LINK_ID_LEN > common_info_limit)
 		return -1;
 
-	return buf[link_id_pos] & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
+	link_id = buf[link_id_pos] & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
+	if (link_id >= MAX_NUM_MLD_LINKS)
+		return -1;
+
+	return link_id;
 }
 
 
