diff --git a/autobuild_mac80211_release/package/kernel/mac80211/patches/subsys/903-mac80211-it-s-invalid-case-when-frag_threshold-is-gr.patch b/autobuild_mac80211_release/package/kernel/mac80211/patches/subsys/903-mac80211-it-s-invalid-case-when-frag_threshold-is-gr.patch
new file mode 100755
index 0000000..2f1d96c
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mac80211/patches/subsys/903-mac80211-it-s-invalid-case-when-frag_threshold-is-gr.patch
@@ -0,0 +1,28 @@
+From a0b3ac0fe37b3f2bcc5a9593524556b971bb98f5 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Fri, 1 Apr 2022 09:15:21 +0800
+Subject: [PATCH] mac80211: it's invalid case when frag_threshold is greater
+ than 2346
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ net/wireless/nl80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index f54cb1a..10f3131 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3478,6 +3478,9 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
+ 			goto out;
+ 		}
+ 
++		if (frag_threshold >= 2346)
++			frag_threshold = (u32) -1;
++
+ 		if (frag_threshold != (u32) -1) {
+ 			/*
+ 			 * Fragments (apart from the last one) are required to
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/0011-mt76-mt7915-add-list_del_init-msta-wcid.list.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/0011-mt76-mt7915-add-list_del_init-msta-wcid.list.patch
new file mode 100755
index 0000000..0ea18c1
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/0011-mt76-mt7915-add-list_del_init-msta-wcid.list.patch
@@ -0,0 +1,31 @@
+From 95953b3adaadf15ad5ae637d4e0e433c3bfb0835 Mon Sep 17 00:00:00 2001
+From: Bo Jiao <Bo.Jiao@mediatek.com>
+Date: Thu, 31 Mar 2022 11:23:02 +0800
+Subject: [PATCH] mt76: mt7915: add list_del_init(&msta->wcid.list)
+
+msta->wcid may use after free when do mt76_tx_status_check
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+---
+ mt7915/main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/mt7915/main.c b/mt7915/main.c
+index 9de5f152..fc271e3c 100644
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -729,6 +729,11 @@ void mt7915_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	if (!list_empty(&msta->rc_list))
+ 		list_del_init(&msta->rc_list);
+ 	spin_unlock_bh(&dev->sta_poll_lock);
++
++	spin_lock_bh(&mdev->status_lock);
++	if (!list_empty(&msta->wcid.list))
++		list_del_init(&msta->wcid.list);
++	spin_unlock_bh(&mdev->status_lock);
+ }
+ 
+ static void mt7915_tx(struct ieee80211_hw *hw,
+-- 
+2.18.0
+
diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/2001-mt76-mt7915-add-L0.5-SER-for-mt7986.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-mt7915-add-L0.5-SER-for-mt7986.patch
similarity index 100%
rename from autobuild_mac80211_release/package/kernel/mt76/patches/2001-mt76-mt7915-add-L0.5-SER-for-mt7986.patch
rename to autobuild_mac80211_release/package/kernel/mt76/patches/1112-mt76-mt7915-add-L0.5-SER-for-mt7986.patch