CVE-2026-93271

A flaw was found in the ath11k wireless driver in the Linux kernel. This vulnerability allows an adjacent attacker within Wi-Fi range to cause a Denial of Service (DoS) by transmitting wireless frames with an out-of-range Modulation and Coding Scheme (MCS) index. Because the driver fails to properly validate and cap the rate metadata, subsequent sanity checks in the networking stack fail, triggering a kernel warning and discarding network traffic.

A denial-of-service flaw of moderate severity was found in the ath11k Wi-Fi driver in the Linux kernel used by Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and the Red Hat CoreOS kernels shipped with OpenShift Container Platform 4. When ath11k receives HT, VHT, or HE frames whose reported Modulation and Coding Scheme (MCS) index exceeds the maximum that the mac80211 rate space can express, the driver leaves invalid rate metadata in the receive status instead of capping it. An unauthenticated attacker within Wi-Fi radio range of a system using affected Qualcomm ath11k wireless hardware can transmit crafted frames with an out-of-range MCS index; when such a frame reaches mac80211 it fails the rate sanity check, triggering a kernel WARNING and causing the frame to be dropped. Repeated transmission of such frames can disrupt wireless network traffic availability, but there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable ath11k code is not present in those releases. The fix is currently deferred on the affected streams because the flaw is of moderate severity with availability-only impact; the residual risk is that an adjacent attacker can degrade Wi-Fi connectivity on systems equipped with ath11k hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.