The vulnerability exists in the morse_page_slicing_process_tim_element() function within the morse.ko kernel driver for HaLowLink 2. It improperly derives the TIM bitmap length from a received Information Element without validating it against the destination buffer size before using memset and memcpy. This leads to a heap-based buffer overflow where attacker-controlled data can overwrite memory beyond the buffer boundary. Because beacon frames are processed during passive scanning and are unauthenticated, an attacker within radio range can trigger this by sending a malicious 802.11ah beacon frame. The flaw affects all versions prior to 2.11.13 of the HaLowLink 2 software.

Successful exploitation can cause a denial of service via kernel panic or potentially allow remote code execution with kernel privileges. The vulnerability requires no authentication or user interaction and can be triggered remotely within radio range, making it highly severe. The CVSS score is 9.8 (critical), reflecting the ease of exploitation and the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, limit exposure by controlling radio range access and monitoring for unusual 802.11ah beacon frames if possible. Avoid relying on generic mitigations as this vulnerability is triggered by unauthenticated broadcast frames.