diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index d7d5a124c..49f8320a0 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -899,7 +899,9 @@ static int hostapd_config_read_int10(const char *value)
 static int valid_cw(int cw)
 {
 	return (cw == 1 || cw == 3 || cw == 7 || cw == 15 || cw == 31 ||
-		cw == 63 || cw == 127 || cw == 255 || cw == 511 || cw == 1023);
+		cw == 63 || cw == 127 || cw == 255 || cw == 511 || cw == 1023 ||
+		cw == 2047 || cw == 4095 || cw == 8191 || cw == 16383 ||
+		cw == 32767);
 }
 
 
diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index 39e9792c6..00fc1421d 100644
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -280,8 +280,9 @@ ignore_broadcast_ssid=0
 #		(data0 is the highest priority queue)
 # parameters:
 #   aifs: AIFS (default 2)
-#   cwmin: cwMin (1, 3, 7, 15, 31, 63, 127, 255, 511, 1023)
-#   cwmax: cwMax (1, 3, 7, 15, 31, 63, 127, 255, 511, 1023); cwMax >= cwMin
+#   cwmin: cwMin (1, 3, 7, 15, 31, 63, 127, 255, 511, 1023, 2047, 4095, 8191,
+#	   16383, 32767)
+#   cwmax: cwMax (same values as cwMin, cwMax >= cwMin)
 #   burst: maximum length (in milliseconds with precision of up to 0.1 ms) for
 #          bursting
 #
@@ -342,8 +343,9 @@ ignore_broadcast_ssid=0
 # note - txop_limit is in units of 32microseconds
 # note - acm is admission control mandatory flag. 0 = admission control not
 # required, 1 = mandatory
-# note - here cwMin and cmMax are in exponent form. the actual cw value used
-# will be (2^n)-1 where n is the value given here
+# note - Here cwMin and cmMax are in exponent form. The actual cw value used
+# will be (2^n)-1 where n is the value given here. The allowed range for these
+# wmm_ac_??_{cwmin,cwmax} is 0..15 with cwmax >= cwmin.
 #
 wmm_enabled=1
 #
diff --git a/src/common/ieee802_11_common.c b/src/common/ieee802_11_common.c
index 82dd70742..5385faf7d 100644
--- a/src/common/ieee802_11_common.c
+++ b/src/common/ieee802_11_common.c
@@ -504,14 +504,14 @@ int hostapd_config_wmm_ac(struct hostapd_wmm_ac_params wmm_ac_params[],
 		ac->aifs = v;
 	} else if (os_strcmp(pos, "cwmin") == 0) {
 		v = atoi(val);
-		if (v < 0 || v > 12) {
+		if (v < 0 || v > 15) {
 			wpa_printf(MSG_ERROR, "Invalid cwMin value %d", v);
 			return -1;
 		}
 		ac->cwmin = v;
 	} else if (os_strcmp(pos, "cwmax") == 0) {
 		v = atoi(val);
-		if (v < 0 || v > 12) {
+		if (v < 0 || v > 15) {
 			wpa_printf(MSG_ERROR, "Invalid cwMax value %d", v);
 			return -1;
 		}