diff --git a/patches.suse/wcn36xx-Fix-TX-data-path.patch b/patches.suse/wcn36xx-Fix-TX-data-path.patch
new file mode 100644
index 0000000..da90a67
--- /dev/null
+++ b/patches.suse/wcn36xx-Fix-TX-data-path.patch
@@ -0,0 +1,80 @@
+From 512b191d965237249999b3c58600fe50356ab323 Mon Sep 17 00:00:00 2001
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Fri, 24 Jul 2020 12:20:50 +0200
+Subject: [PATCH] wcn36xx: Fix TX data path
+Git-commit: 512b191d965237249999b3c58600fe50356ab323
+References: git-fixes
+Patch-mainline: v5.10-rc1
+
+This patch contains the following fixes:
+
+- Use correct queue for submitting QoS packet. The queue id to use
+is a one-to-one mapping with the TID.
+
+- Don't encrypt a frame with IEEE80211_TX_INTFL_DONT_ENCRYPT flag.
+
+- Use the 'special queue' for null packets, preventing the firmware
+to submit it as AMPDU.
+
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1595586052-16081-5-git-send-email-loic.poulain@linaro.org
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/net/wireless/ath/wcn36xx/txrx.c |   23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
++++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
+@@ -267,9 +267,11 @@ static void wcn36xx_set_tx_data(struct w
+ 				bool bcast)
+ {
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
++	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ 	struct ieee80211_vif *vif = NULL;
+ 	struct wcn36xx_vif *__vif_priv = NULL;
+-	bool is_data_qos;
++	bool is_data_qos = ieee80211_is_data_qos(hdr->frame_control);
++	u16 tid = 0;
+ 
+ 	bd->bd_rate = WCN36XX_BD_RATE_DATA;
+ 
+@@ -297,10 +299,21 @@ static void wcn36xx_set_tx_data(struct w
+ 		bd->dpu_desc_idx = __vif_priv->self_dpu_desc_index;
+ 		bd->dpu_sign = __vif_priv->self_ucast_dpu_sign;
+ 	}
++	if (is_data_qos) {
++		tid = ieee80211_get_tid(hdr);
++		/* TID->QID is one-to-one mapping */
++		bd->queue_id = tid;
++	}
+ 
+-	if (ieee80211_is_nullfunc(hdr->frame_control) ||
+-	   (sta_priv && !sta_priv->is_data_encrypted))
++	if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT ||
++			(sta_priv && !sta_priv->is_data_encrypted)) {
+ 		bd->dpu_ne = 1;
++	}
++
++	if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
++		/* Don't use a regular queue for null packet (no ampdu) */
++		bd->queue_id = WCN36XX_TX_U_WQ_ID;
++	}
+ 
+ 	if (bcast) {
+ 		bd->ub = 1;
+@@ -308,13 +321,11 @@ static void wcn36xx_set_tx_data(struct w
+ 	}
+ 	*vif_priv = __vif_priv;
+ 
+-	is_data_qos = ieee80211_is_data_qos(hdr->frame_control);
+-
+ 	wcn36xx_set_tx_pdu(bd,
+ 			   is_data_qos ?
+ 			   sizeof(struct ieee80211_qos_hdr) :
+ 			   sizeof(struct ieee80211_hdr_3addr),
+-			   skb->len, sta_priv ? sta_priv->tid : 0);
++			   skb->len, tid);
+ 
+ 	if (sta_priv && is_data_qos)
+ 		wcn36xx_tx_start_ampdu(wcn, sta_priv, skb);
diff --git a/series.conf b/series.conf
index 5d0f63f..449e22f 100644
--- a/series.conf
+++ b/series.conf
@@ -58493,6 +58493,7 @@
 	patches.suse/ath10k-check-idx-validity-in-__ath10k_htt_rx_ring_fi.patch
 	patches.suse/wcn36xx-Fix-multiple-AMPDU-sessions-support.patch
 	patches.suse/wcn36xx-Increase-number-of-TX-retries.patch
+	patches.suse/wcn36xx-Fix-TX-data-path.patch
 	patches.suse/ath10k-start-recovery-process-when-payload-length-ex.patch
 	patches.suse/ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch
 	patches.suse/ath9k_htc-Use-appropriate-rs_datalen-type.patch