The vulnerability exists in the morse.ko kernel driver component of Morse Micro HaLowLink 2 software versions prior to 2.11.12. The function morse_vendor_find_vendor_ie() insufficiently checks the length of a Vendor Information Element (IE) in 802.11ah frames, only requiring it to be longer than 3 bytes. Subsequent functions morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info() read fixed offsets into this IE data, which can lead to an out-of-bounds read of up to 9 bytes from kernel heap memory if the IE is undersized. This can disclose kernel memory or cause a kernel panic (denial of service). Exploitation requires only proximity within radio range and no authentication or association.

An attacker within radio range can exploit this vulnerability to read a small amount of kernel heap memory, potentially disclosing sensitive information. Alternatively, the attacker can cause a denial of service by triggering a kernel panic or oops. The impact is limited to information disclosure of a small memory region or service disruption. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider limiting exposure of affected devices to untrusted radio environments. Monitor vendor channels for updates or patches addressing this vulnerability.