diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7276e66ae435..274bfa980a67 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -516,10 +516,22 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
 		if (!sta)
 			goto out_unlock;
 
-		if (pairwise)
+		if (pairwise) {
+			if (key_idx >= NUM_DEFAULT_KEYS) {
+				ret = -EINVAL;
+				goto out_unlock;
+			}
 			key = key_mtx_dereference(local, sta->ptk[key_idx]);
-		else
+		}
+		else {
+			if (key_idx >= NUM_DEFAULT_KEYS +
+					       NUM_DEFAULT_MGMT_KEYS +
+					       NUM_DEFAULT_BEACON_KEYS) {
+				ret = -EINVAL;
+				goto out_unlock;
+			}
 			key = key_mtx_dereference(local, sta->gtk[key_idx]);
+		}
 	} else
 		key = key_mtx_dereference(local, sdata->keys[key_idx]);