--- a/net/mac80211/agg-rx.c +++ b/net/mac80211/agg-rx.c @@ -493,7 +493,7 @@ void ieee80211_process_addba_request(str ies_len = len - offsetof(struct ieee80211_mgmt, u.action.u.addba_req.variable); - if (ies_len) { + if (ies_len && (mgmt->u.action.u.addba_req.variable[0] == WLAN_EID_ADDBA_EXT)) { ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable, ies_len, true, &elems, mgmt->bssid, NULL); if (elems.parse_error)