The ath11k Wi‑Fi driver in Linux kernels mishandles frames that report a Modulation and Coding Scheme (MCS) value exceeding the maximum supported by the hardware. Instead of leaving the rate indicator blank, the driver assigns an out‑of‑range rate index and keeps an uninitialized encoding value. When such a frame reaches the mac80211 stack, a sanity check fails, the frame is dropped, and a warning is logged. The user experiences loss of otherwise valid packets and degraded network throughput, but the flaw does not give an attacker code execution or privilege escalation capabilities.

Linux kernel systems that include the ath11k driver, notably those using Qualcomm’s ath11k family such as the WCN6855. Any kernel build prior to the patch commit (12b09e4) is affected. The issue appears in all distributions that ship these kernels without the fix.

The problem can be triggered by sending crafted Wi‑Fi frames with MCS values above the device’s limit, which requires no privileged access and can be performed remotely by simply transmitting on the same frequency band. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the low activation barrier and the impact on local connectivity make the overall risk moderate to high. The CVSS score is 5.5, indicating moderate severity.