CVE-2026-7762 Details
Description
A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction.
A heap-based buffer overflow vulnerability has been identified in the dot11ah.ko HaLow Wi-Fi kernel driver, specifically in Morse Micro HaLowLink 2 software versions prior to 2.11.13. This vulnerability allows an unauthenticated attacker within radio range to cause a denial-of-service condition (kernel panic) or potentially achieve remote code execution. The issue arises when the driver processes a malformed S1G Capabilities Information Element in 802.11ah beacon or probe response frames. The vulnerable function, morse_dot11ah_find_s1g_caps_for_bssid(), improperly uses the length field of the Information Element, leading to a buffer overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. This vulnerability can be exploited during normal scanning operations, without the need for authentication, association, or user interaction.
Users are advised to upgrade to Morse Micro HaLowLink 2 software version 2.11.13 or later. Customers using the dot11ah.ko driver in their own Linux integrations should contact Morse Micro for the patched source if their driver release predates 2.11.13.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.morsemicro.com/security-advisories/MM-SA-2026-002 | Bugcrowd Inc. |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | Bugcrowd Inc. |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | Bugcrowd Inc. |