NewsPublished 10 Jun 2026

Flooding invalid deauth frames still kicks PMF clients, tested on 3 Android phones

Source Reddit Cybersecurity

Discussion

A Wi-Fi deauthentication flooding tool named KTO can disconnect clients protected by Protected Management Frames (PMF) on some Android phones by overwhelming them with invalid deauth frames. Despite PMF rejecting unprotected frames cryptographically, aggressive flooding causes disconnections within seconds. The tool continuously scans and deauthenticates clients automatically without manual targeting. This behavior was tested on three Android devices with the latest security patches. The effectiveness against other platforms like iOS, Windows, or IoT devices is unknown.

r/cybersecurity (opens in a new tab)u/Trick-Resolve-60850 points0 comments

Enabled PMF on my AP, expected my deauth tool to fail. It didn’t.

Even though every frame gets rejected by the crypto, flooding enough of them in aggressive mode still disconnected all three Android phones I tested (latest security patch). Took around 9 seconds on average.

Has anyone else seen this on iOS, Windows, or IoT? Curious how widespread it is.

For anyone asking; the tool scans and deauths in parallel so there’s no breathing room and the agressive mode is what let me discover this.

https://github.com/Ymsniper/KTO

Links cited in the discussion

https://github.com/Ymsniper/KTO

Impact

Clients with PMF enabled, specifically tested on three Android phones with the latest security patches, can be disconnected from Wi-Fi networks by flooding invalid deauthentication frames. This results in denial of service for affected clients. The attack bypasses the cryptographic protections of PMF not by breaking the protocol but by overwhelming the client with a high volume of invalid frames. The impact on other platforms such as iOS, Windows, or IoT devices is currently unknown. There is no indication of data compromise or privilege escalation, only forced disconnection.

Defensive guidance

Since the attack relies on flooding invalid deauth frames to overwhelm PMF clients, mitigation options are limited. Network operators should monitor for unusual deauthentication frame floods and consider additional network-level protections such as intrusion detection systems that can detect and block deauth flood attacks. Clients and vendors should be made aware of this limitation in PMF implementations. Until patches or mitigations are available, restricting physical proximity to the wireless network and using wired connections where possible may reduce exposure.

Summary

KTO is a Wi-Fi deauthentication tool that automatically discovers and disconnects clients from a target SSID by flooding deauthentication frames. Although PMF (802.11w) is designed to protect against such attacks by cryptographically rejecting unprotected deauth frames, KTO's aggressive mode floods invalid deauth frames in parallel with scanning, causing some PMF-protected Android clients to disconnect after about 9 seconds. This indicates that PMF implementations on these devices can be overwhelmed by high-volume deauth frame floods, resulting in denial of service despite PMF protections. The tool supports whitelisting, multi-AP environments, and can operate without manual client targeting.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 10 Jun 2026, 02:25 UTC

Technical details

References

Community reviews