This vulnerability (CVE-2026-7762) exists in the dot11ah.ko HaLow Wi-Fi kernel driver of Morse Micro HaLowLink 2 software versions before 2.11.13. The function morse_dot11ah_find_s1g_caps_for_bssid() improperly uses the IE length field as the size argument to memcpy without validating it against the fixed 15-byte destination buffer. An attacker can send a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities IE (element ID 0xD9) with up to 255 bytes, causing a heap-based buffer overflow of up to 240 bytes into adjacent kernel heap memory. This can trigger a denial of service (kernel panic) or potentially remote code execution. The attack can be performed by an unauthenticated attacker within radio range during normal scanning without user interaction.

Successful exploitation can cause a denial of service via kernel panic or potentially allow remote code execution with kernel privileges. The vulnerability is exploitable remotely by an unauthenticated attacker within radio range, making it highly severe. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided data. Until a patch is available, limiting exposure to untrusted 802.11ah networks or disabling scanning for 802.11ah networks may reduce risk, but these are not confirmed mitigations from the vendor.