Morse Micro HaLowLink 2 up to 2.11.12 dot11ah.ko morse_dot11ah_find_s1g_caps_for_bssid heap-based overflow

Summaryinfo

A vulnerability was found in Morse Micro HaLowLink 2 up to 2.11.12. It has been declared as critical. This impacts the function morse_dot11ah_find_s1g_caps_for_bssid in the library dot11ah.ko. The manipulation results in heap-based overflow. This vulnerability is known as CVE-2026-7762. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Morse Micro HaLowLink 2 up to 2.11.12. Affected is the function morse_dot11ah_find_s1g_caps_for_bssid in the library dot11ah.ko. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction.

The advisory is available at morsemicro.com. This vulnerability is traded as CVE-2026-7762 since 05/04/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 2.11.13 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Morse Micro

Name

• HaLowLink 2

Version

• 2.11.0
• 2.11.1
• 2.11.2
• 2.11.3
• 2.11.4
• 2.11.5
• 2.11.6
• 2.11.7
• 2.11.8
• 2.11.9
• 2.11.10
• 2.11.11
• 2.11.12

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion