CVE-2026-93271
Received Received - Intake

Out-of-Range MCS Handling in ath11k WiFi Driver

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate ath11k can receive HT/VHT/HE frames whose reported MCS is above the maximum that can be expressed in the corresponding mac80211 rate space (e.g. an HE frame reported with MCS 12, while HE tops out at MCS 11). The frame itself is valid and decodes correctly, but for such a frame ath11k_dp_rx_h_rate() leaves rx_status->rate_idx set to the out-of-range value and never assigns rx_status->encoding, so it stays RX_ENC_LEGACY from the ath11k_dp_rx_h_ppdu() initialization. Once that frame reaches mac80211 it trips the rate sanity check and the frame is dropped with a splat: ath11k_pci 0000:03:00.0: Received with invalid mcs in HE mode 12 WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:5433 ieee80211_rx_list+0xb0a/0xe90 [mac80211] Dropping the frame would discard otherwise valid data, so instead cap the reported MCS to the maximum the rate space can express and deliver the frame. Set rx_status->encoding before the range check and assign rate_idx from the capped value, so a frame with an out-of-range MCS no longer leaves partial or bogus rate metadata behind. Also downgrade the logging level since they are not treated as invalid frames now. The only loss is that such a frame is reported as the capped MCS in the rx rate statistics. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93271
EUVD
EUVD-2026-86143

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qualcomm ath11k From 3.6510.41 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the ath11k Wi-Fi driver. It occurs when the driver receives Wi-Fi frames with a Modulation and Coding Scheme (MCS) value that exceeds the maximum supported for the frame type (e.g., HE frames with MCS 12 when the maximum is 11). The driver incorrectly sets rate metadata, causing mac80211 to drop valid frames due to a rate sanity check failure.

Detection Guidance

This vulnerability may be detected by monitoring kernel logs for warnings related to invalid MCS values in HE mode. Check dmesg or journalctl for messages like 'Received with invalid mcs in HE mode'.

Impact Analysis

This vulnerability can cause valid Wi-Fi frames to be dropped, leading to potential data loss or connectivity issues. Users may experience reduced network reliability or performance when connected to affected devices using the ath11k driver.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves a technical issue in the Linux kernel's ath11k Wi-Fi driver where out-of-range MCS values in received frames cause data loss due to frame dropping. No evidence suggests this impacts data privacy, security controls, or regulatory compliance requirements.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this ath11k issue. Monitor vendor advisories for Qualcomm ath11k firmware updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart