--- a/mt7915/mcu.c
+++ b/mt7915/mcu.c
@@ -4887,7 +4887,7 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt
 	rcu_read_lock();
 
 	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
-	if (wcid) {
+	if (wcid && wcid->sta) {
 		struct ieee80211_vif *vif;
 		struct wireless_dev *wdev;
 
@@ -4898,12 +4898,12 @@ int mt7915_mcu_wed_wa_tx_stats(struct mt
 		    !sta)
 			 goto unlock;
 
+		if (!sta->vif)
+			goto unlock;
+
 		vif = container_of((void *)sta->vif,
 				   struct ieee80211_vif,
 				   drv_priv);
-		if (!vif)
-			goto unlock;
-
 		wdev = ieee80211_vif_to_wdev(vif);
 
 		if (vif->type == NL80211_IFTYPE_MONITOR)