This vulnerability arises from improper validation of the length field in the S1G Capabilities IE (element ID 0xD9) within the HaLow Wi-Fi kernel driver (dot11ah.ko) in Morse Micro HaLowLink 2 software versions prior to 2.11.13. The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without verifying it against the fixed 15-byte destination buffer, allowing an attacker to supply up to 255 bytes. This causes a heap-based buffer overflow of up to 240 bytes of attacker-controlled data into adjacent kernel memory. The vulnerability can be triggered by an unauthenticated attacker within radio range via crafted 802.11ah beacon or probe response frames during normal scanning, potentially leading to Denial of Service or remote code execution.

An attacker within radio range can exploit this vulnerability without authentication or user interaction. The heap-based buffer overflow can cause a kernel panic, resulting in Denial of Service. More critically, it may allow remote code execution in kernel context, which could lead to full system compromise. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by controlling physical access to the wireless environment and monitoring for suspicious 802.11ah frames if possible. No official fix or temporary workaround has been published by Morse Micro as of now.