diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2a85bff6a8f352dbd6be8f55f145dfc4625fa50f..6168db3c35e4c066d9c88a214c095e658ff7e12c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10270,9 +10270,11 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
 	hyst = wdev->cqm_config->rssi_hyst;
 	n = wdev->cqm_config->n_rssi_thresholds;
 
-	for (i = 0; i < n; i++)
+	for (i = 0; i < n; i++) {
+		i = array_index_nospec(i, n);
 		if (last < wdev->cqm_config->rssi_thresholds[i])
 			break;
+	}
 
 	low_index = i - 1;
 	if (low_index >= 0) {