PT-2026-46900 · Morse Micro · Halowlink 2
Published
2026-06-05
·
Updated
2026-06-05
·
CVE-2026-7762
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse dot11ah find s1g caps for bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Halowlink 2