diff --git a/mt76x2_main.c b/mt76x2_main.c
index 7cab1aec..326f5bba 100644
--- a/mt76x2_main.c
+++ b/mt76x2_main.c
@@ -188,28 +188,6 @@ mt76x2_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	mutex_unlock(&dev->mutex);
 }
 
-static int
-mt76_wcid_alloc(struct mt76x2_dev *dev)
-{
-	int i, idx = 0;
-
-	for (i = 0; i < ARRAY_SIZE(dev->wcid_mask); i++) {
-		idx = ffs(~dev->wcid_mask[i]);
-		if (!idx)
-			continue;
-
-		idx--;
-		dev->wcid_mask[i] |= BIT(idx);
-		break;
-	}
-
-	idx = i * BITS_PER_LONG + idx;
-	if (idx > 247)
-		return -1;
-
-	return idx;
-}
-
 static int
 mt76x2_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	     struct ieee80211_sta *sta)
@@ -223,7 +201,7 @@ mt76x2_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 
 	mutex_lock(&dev->mutex);
 
-	idx = mt76_wcid_alloc(dev);
+	idx = mt76_wcid_alloc(dev->wcid_mask, ARRAY_SIZE(dev->wcid));
 	if (idx < 0) {
 		ret = -ENOSPC;
 		goto out;
diff --git a/util.c b/util.c
index 0b490691..01fc5ab0 100644
--- a/util.c
+++ b/util.c
@@ -79,4 +79,26 @@ bool __mt76_poll_msec(struct mt76_dev *dev, u32 offset, u32 mask, u32 val,
 }
 EXPORT_SYMBOL_GPL(__mt76_poll_msec);
 
+int mt76_wcid_alloc(unsigned long *mask, int size)
+{
+	int i, idx = 0, cur;
+
+	for (i = 0; i < size / BITS_PER_LONG; i++) {
+		idx = ffs(~mask[i]);
+		if (!idx)
+			continue;
+
+		idx--;
+		cur = i * BITS_PER_LONG + idx;
+		if (cur >= size)
+			break;
+
+		mask[i] |= BIT(idx);
+		return cur;
+	}
+
+	return -1;
+}
+EXPORT_SYMBOL_GPL(mt76_wcid_alloc);
+
 MODULE_LICENSE("GPL");
diff --git a/util.h b/util.h
index 449cb503..e4b9840f 100644
--- a/util.h
+++ b/util.h
@@ -82,6 +82,7 @@
 
 int mt76_insert_hdr_pad(struct sk_buff *skb);
 void mt76_remove_hdr_pad(struct sk_buff *skb);
+int mt76_wcid_alloc(unsigned long *mask, int size);
 
 static inline void
 mt76_skb_set_moredata(struct sk_buff *skb, bool enable)