new file mode 100644
@@ -0,0 +1,49 @@
+From 7ab2de9eecf5409f6af1461cf89dbf217930bd45 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
+Date: Tue, 31 Mar 2026 23:24:04 +0300
+Subject: [PATCH] AP MLD: Fix link ID validation in Basic MLE parsing
+
+Link ID 15 can be indicated in the field, but that is not a valid value
+and must be rejected to avoid issues pointing beyond the array of links
+for a non-AP MLD. Without this, an invalid MLE could result in writing
+beyond the end of the buffer and causing process termination or
+unexpected behavior.
+
+Fixes: 5f5db9366cde ("AP: MLO: Process Multi-Link element from (Re)Association Request frame")
+Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
+
+CVE: CVE-2026-58374
+Upstream-Status: Backport [https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/ap/ieee802_11_eht.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/ap/ieee802_11_eht.c b/src/ap/ieee802_11_eht.c
+index b935ee8..804808c 100644
+--- a/src/ap/ieee802_11_eht.c
++++ b/src/ap/ieee802_11_eht.c
+@@ -1262,6 +1262,7 @@ u16 hostapd_process_ml_assoc_req(struct hostapd_data *hapd,
+ size_t sub_elem_len = *(pos + 1);
+ size_t sta_info_len;
+ u16 control;
++ u8 link_id;
+
+ wpa_printf(MSG_DEBUG, "MLD: sub element len=%zu",
+ sub_elem_len);
+@@ -1302,8 +1303,13 @@ u16 hostapd_process_ml_assoc_req(struct hostapd_data *hapd,
+ goto out;
+ }
+ control = WPA_GET_LE16(pos);
+- link_info = &info->links[control &
+- EHT_PER_STA_CTRL_LINK_ID_MSK];
++ link_id = control & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
++ if (link_id >= MAX_NUM_MLD_LINKS) {
++ wpa_printf(MSG_DEBUG,
++ "MLD: Invalid Link ID in Per-STA Profile subelement");
++ goto out;
++ }
++ link_info = &info->links[link_id];
+ pos += 2;
+ ml_len -= 2;
+ sub_elem_len -= 2;
new file mode 100644
@@ -0,0 +1,43 @@
+From 86cefb9f27e0e2d31d857bea483b0735e6441801 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
+Date: Mon, 18 May 2026 15:45:15 +0300
+Subject: [PATCH] AP MLD: Verify AP MLD link ID validity before updating bitmap
+ of links
+
+Link ID is 0..14, so ignore value 15 if an invalid frame is processed.
+It does not look like the invalid value was actually used to reference
+any local array, but in any case, it is better to not mark an invalid
+link as being specified.
+
+Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
+
+CVE: CVE-2026-58374
+Upstream-Status: Backport [https://git.w1.fi/cgit/hostap/commit/?id=ce1a8612e309fe86133ecf05ffb452b0bdf3b035]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/ap/beacon.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/ap/beacon.c b/src/ap/beacon.c
+index cec0c98..cc295c1 100644
+--- a/src/ap/beacon.c
++++ b/src/ap/beacon.c
+@@ -1305,6 +1305,7 @@ static bool parse_ml_probe_req(const struct ieee80211_eht_ml *ml, size_t ml_len,
+ for_each_element_id(sub, 0, pos, len) {
+ const struct ieee80211_eht_per_sta_profile *sta;
+ u16 sta_control;
++ u8 link_id;
+
+ if (*links == 0xffff)
+ *links = 0;
+@@ -1324,7 +1325,9 @@ static bool parse_ml_probe_req(const struct ieee80211_eht_ml *ml, size_t ml_len,
+ * partial profile was requested.
+ */
+ sta_control = le_to_host16(sta->sta_control);
+- *links |= BIT(sta_control & EHT_PER_STA_CTRL_LINK_ID_MSK);
++ link_id = sta_control & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
++ if (link_id < MAX_NUM_MLD_LINKS)
++ *links |= BIT(link_id);
+ }
+
+ if (!for_each_element_completed(sub, pos, len)) {
@@ -15,6 +15,8 @@ SRC_URI = " \
file://hostapd.service \
file://CVE-2025-24912-01.patch \
file://CVE-2025-24912-02.patch \
+ file://CVE-2026-58374-1.patch \
+ file://CVE-2026-58374-2.patch \
"