This vulnerability arises from improper validation of the TIM bitmap length in the morse_page_slicing_process_tim_element() function within the morse.ko kernel driver of Morse Micro HaLowLink 2 software versions before 2.11.13. The function uses the length derived directly from a received Information Element without verifying it against the fixed-size destination buffer, leading to up to 252 bytes of attacker-controlled data being written beyond the buffer boundary via memset and memcpy. Because the malformed TIM IE is delivered in 802.11ah beacon frames, which are broadcast and processed during passive scanning, exploitation requires only proximity to the device and no authentication. This can cause a kernel panic or potentially allow remote code execution.

Successful exploitation can cause a denial of service through a kernel panic or potentially enable remote code execution on affected devices. The vulnerability can be triggered by an unauthenticated attacker within radio range, increasing the risk in environments where the device is exposed to untrusted wireless signals. No known exploits in the wild have been reported. The lack of authentication requirement and the ability to trigger the flaw via broadcast frames increase the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting physical proximity to trusted devices and monitoring for unusual device behavior. Avoid relying on generic mitigations as no vendor advisory or patch information is currently provided.