An out-of-bounds read vulnerability exists in the morse.ko HaLow Wi-Fi kernel driver component of Morse Micro HaLowLink 2 software versions before 2.11.12. The function morse_vendor_find_vendor_ie() insufficiently validates the length of the Vendor Information Element (IE) in 802.11ah beacon or probe response frames, requiring only that the IE length be greater than 3 bytes. This allows an attacker to supply an undersized IE, causing subsequent functions morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info() to read beyond the allocated IE buffer by up to 9 bytes. This memory disclosure can leak kernel heap data or cause a kernel panic (denial of service). The attack requires only proximity within radio range and no authentication or association.

An attacker within radio range can exploit this vulnerability to read a small amount of kernel heap memory, potentially disclosing sensitive information. Additionally, the vulnerability can cause a kernel panic, resulting in denial of service. No authentication, association, or user interaction is required to exploit this issue. The CVSS 3.1 base score is 6.8 (medium severity), reflecting low confidentiality impact but high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects versions prior to 2.11.12; upgrading to version 2.11.12 or later is implied to address the issue. Until an official fix is confirmed, avoid exposure to untrusted 802.11ah frames or restrict radio range access where possible.