CVE-2026-7763 Details
Description
A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. The function morse_page_slicing_process_tim_element() in page_slicing.c derives the TIM bitmap length directly from a received IE field without validating it against the fixed-size destination buffer before passing it to memset and memcpy operations, allowing up to 252 bytes of attacker-controlled data to be written beyond the buffer boundary. Because beacons are broadcast frames processed during passive scanning, no authentication, association, or user interaction is required.
A heap-based buffer overflow vulnerability has been identified in the 'morse.ko' HaLow Wi-Fi kernel driver, part of Morse Micro's HaLowLink 2 software, all versions prior to 2.11.13. This vulnerability allows an unauthenticated attacker within radio range to cause a denial-of-service condition, leading to a kernel panic, or potentially execute remote code. The issue arises in the 'morse_page_slicing_process_tim_element()' function, where the Traffic Indication Map (TIM) Information Element is processed without proper validation, allowing up to 252 bytes of attacker-controlled data to be written beyond the buffer's boundary. Exploitation involves sending a crafted 802.11ah beacon frame containing a malformed TIM element, taking advantage of the driver's passive scanning mode, which requires no authentication or user interaction.
Users are advised to upgrade to HaLowLink 2 software version 2.11.13 or later. For those using the 'morse.ko' driver in their own Linux integrations, contact Morse Micro for the patched source.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.morsemicro.com/security-advisories/MM-SA-2026-001 | Bugcrowd Inc. |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | Bugcrowd Inc. |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | Bugcrowd Inc. |