--- a/net/mac80211/agg-rx.c +++ b/net/mac80211/agg-rx.c @@ -494,7 +494,7 @@ void ieee80211_process_addba_request(str ies_len = len - offsetof(struct ieee80211_mgmt, u.action.u.addba_req.variable); - if (ies_len) { + if (ies_len && (mgmt->u.action.u.addba_req.variable[0] == WLAN_EID_ADDBA_EXT)) { elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable, ies_len, true, mgmt->bssid, NULL); if (!elems || elems->parse_error)