# CVE-2026-93271: Linux kernel ath11k invalid MCS handling in rx rate processing

Source: https://junglewise.ai/threats/cve-2026-93271-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93271 · Severity: info · Published 2026-09-24

The ath11k WiFi driver in the Linux kernel failed to properly handle received frames with out-of-range modulation coding scheme (MCS) values, causing valid wireless frames to be discarded with warnings. The fix ensures such frames are processed normally by capping the MCS to valid ranges rather than dropping them, improving wireless reception reliability.

Technologies: [Linux kernel](https://junglewise.ai/threats/technologies/x-linux-kernel).

## Quick answers

**Is CVE-2026-93271 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93271 being exploited in the wild.

**How severe is CVE-2026-93271?** Informational severity, published 24 September 2026.

**Which products and versions are affected?** Linux kernel multiple kernel versions with ath11k driver.

**Is there a fix for CVE-2026-93271?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93271 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-93271?** Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ath11k_dp_rx_h_rate() function in drivers/net/wireless/ath/ath11k/dp_rx.c did not validate received HT/VHT/HE frame MCS values against mac80211 limits before processing; frames with out-of-range MCS (e.g. HE MCS 12 when max is 11) left rx_status->rate_idx in an invalid state while encoding remained unset, causing mac80211 to reject them. The fix caps out-of-range MCS values to valid maximums and sets the encoding field correctly, allowing frames to be processed rather than dropped.

## Affected products

- Linux kernel multiple kernel versions with ath11k driver

## Timeline

- 2026-07-01: other: Initial patch authored
- 2026-09-24: disclosed

## References

- [https://git.kernel.org/stable/c/12b09e478aa7459b7893a695ef77682202f2da83](https://git.kernel.org/stable/c/12b09e478aa7459b7893a695ef77682202f2da83)
- [https://git.kernel.org/stable/c/2bb2a778a487305bd378db5fd5014fbdce4ada2c](https://git.kernel.org/stable/c/2bb2a778a487305bd378db5fd5014fbdce4ada2c)

## Related threats

- [Linux kernel mmap bounds check vulnerability in mman.c](https://junglewise.ai/threats/cve-2026-58813-in-mmap-of-mman-c-there-is-a-possible-way-to-trigger-an-out-of)
- [Linux kernel TIPC double fetch information disclosure](https://junglewise.ai/threats/cve-2026-0193-in-handle-rx-msg-of-tipc-virtio-dev-there-is-a-possible-double)
- [Linux kernel xen-netback use-after-free in mcast_addr_list_free](https://junglewise.ai/threats/cve-2026-100081-in-the-linux-kernel-the-following-vulnerability-has-been)
- [Linux kernel io_uring denial of service via preemption window](https://junglewise.ai/threats/cve-2026-99252-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel printk kthread boot hang in SMP systems](https://junglewise.ai/threats/cve-2026-99250-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)