diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7276e66ae435..e7b2cf4bb0ef 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -516,12 +516,31 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
 		if (!sta)
 			goto out_unlock;
 
-		if (pairwise)
+		if (pairwise) {
+			if (key_idx >= NUM_DEFAULT_KEYS) {
+				ret = -EINVAL;
+				goto out_unlock;
+			}
 			key = key_mtx_dereference(local, sta->ptk[key_idx]);
-		else
+		}
+		else {
+			if (key_idx >=  NUM_DEFAULT_KEYS +
+					NUM_DEFAULT_MGMT_KEYS +
+					NUM_DEFAULT_BEACON_KEYS) {
+				ret = -EINVAL;
+				goto out_unlock;
+			}
 			key = key_mtx_dereference(local, sta->gtk[key_idx]);
-	} else
+		}
+	} else {
+		if (key_idx >=  NUM_DEFAULT_KEYS + 
+				NUM_DEFAULT_MGMT_KEYS +
+				NUM_DEFAULT_BEACON_KEYS) {
+			ret = -EINVAL;
+			goto out_unlock;
+		}
 		key = key_mtx_dereference(local, sdata->keys[key_idx]);
+	}
 
 	if (!key) {
 		ret = -ENOENT;