Executive brief
A security vulnerability exists in the Wi-Fi driver for Morse Micro HaLowLink 2 devices, which are used for long-range IoT wireless connectivity. An attacker within radio range could send a specially crafted Wi-Fi signal to crash the device or potentially steal small amounts of sensitive information from the system's memory. This attack does not require the attacker to be logged in or for a user to take any action.
Technical details
An out-of-bounds read vulnerability exists in the morse.ko kernel driver due to insufficient validation of Vendor Information Element (IE) lengths. Specifically, the function morse_vendor_find_vendor_ie() only verifies that an IE is longer than 3 bytes before passing it to functions that read at fixed offsets. An attacker can transmit a crafted 802.11ah beacon or probe response frame with an undersized IE to trigger a heap out-of-bounds read of up to 9 bytes. This can result in a kernel panic (DoS) or the disclosure of kernel heap memory. The vulnerability is exploitable by any unauthenticated attacker within radio range without user interaction. This issue is resolved in HaLowLink 2 version 2.11.12.
Affected products
- Morse Micro HaLowLink 2 prior to 2.11.12
Timeline
- 2026-06-04: advisory: NVD publication date
- 2026-06-04: disclosed: Public disclosure of CVE-2026-7764