CVE-2026-93271

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate<br /> <br /> ath11k can receive HT/VHT/HE frames whose reported MCS is above the<br /> maximum that can be expressed in the corresponding mac80211 rate space<br /> (e.g. an HE frame reported with MCS 12, while HE tops out at MCS 11).<br /> <br /> The frame itself is valid and decodes correctly, but for such a frame<br /> ath11k_dp_rx_h_rate() leaves rx_status-&gt;rate_idx set to the out-of-range<br /> value and never assigns rx_status-&gt;encoding, so it stays RX_ENC_LEGACY<br /> from the ath11k_dp_rx_h_ppdu() initialization. Once that frame reaches<br /> mac80211 it trips the rate sanity check and the frame is dropped with a<br /> splat:<br /> <br /> ath11k_pci 0000:03:00.0: Received with invalid mcs in HE mode 12<br /> WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:5433 ieee80211_rx_list+0xb0a/0xe90 [mac80211]<br /> <br /> Dropping the frame would discard otherwise valid data, so instead cap the<br /> reported MCS to the maximum the rate space can express and deliver the<br /> frame. Set rx_status-&gt;encoding before the range check and assign rate_idx<br /> from the capped value, so a frame with an out-of-range MCS no longer<br /> leaves partial or bogus rate metadata behind. Also downgrade the logging<br /> level since they are not treated as invalid frames now. The only loss is<br /> that such a frame is reported as the capped MCS in the rx rate statistics.<br /> <br /> Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41