CVE-2026-93271

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate

ath11k can receive HT/VHT/HE frames whose reported MCS is above the

maximum that can be expressed in the corresponding mac80211 rate space

(e.g. an HE frame reported with MCS 12, while HE tops out at MCS 11).

The frame itself is valid and decodes correctly, but for such a frame

ath11k_dp_rx_h_rate() leaves rx_status->rate_idx set to the out-of-range

value and never assigns rx_status->encoding, so it stays RX_ENC_LEGACY

from the ath11k_dp_rx_h_ppdu() initialization. Once that frame reaches

mac80211 it trips the rate sanity check and the frame is dropped with a

splat:

ath11k_pci 0000:03:00.0: Received with invalid mcs in HE mode 12

WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:5433 ieee80211_rx_list+0xb0a/0xe90 [mac80211]

Dropping the frame would discard otherwise valid data, so instead cap the

reported MCS to the maximum the rate space can expres

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References