Threat Intelligence Database

CVE-2026-7763 is a critical heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver of Morse Micro HaLowLink 2 software versions prior to 2.11.13. An unauthenticated attacker within radio range can exploit this by sending a crafted 802.11ah beacon frame with a malformed Traffic Indication Map (TIM) Information Element. This can cause a denial of service (kernel panic) or potentially remote code execution. The vulnerability arises because the TIM bitmap length is not validated against the fixed-size buffer before memory operations, allowing up to 252 bytes of overflow. No authentication or user interaction is required for exploitation.

CVE-2026-7762 is a critical heap-based buffer overflow vulnerability in the Morse Micro HaLowLink 2 dot11ah.ko kernel driver affecting versions prior to 2.11.13. An unauthenticated attacker within radio range can exploit this by sending a crafted 802.11ah beacon or probe response frame with a malformed S1G Capabilities Information Element, causing a kernel panic or potentially remote code execution. The vulnerability arises because the driver copies up to 255 bytes into a 15-byte buffer without proper length validation. Exploitation requires no authentication or user interaction and can occur during normal scanning.

An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker within radio range to disclose a small amount of kernel heap memory or cause a Denial of Service (kernel oops/panic) via a crafted 802.11ah beacon or probe response frame containing a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate the IE length against the expected structure size before its result is passed to morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info(), which read at fixed offsets into the IE data. Because the length check only requires the IE to be longer than 3 bytes, an attacker can supply an undersized IE, causing a heap out-of-bounds read of up to 9 bytes. No authentication, association, or user interaction is required.