CVE-2026-7764 Details

A vulnerability allowing out-of-bounds read has been identified in the morse.ko HaLow Wi-Fi kernel driver, part of Morse Micro HaLowLink 2 software versions prior to 2.11.12. This vulnerability allows an unauthenticated attacker within radio range to either disclose a small amount of kernel heap memory or cause a denial-of-service condition, such as a kernel oops or panic. The issue arises when the driver processes a malformed Vendor Information Element in an 802.11ah beacon or probe response frame. The function morse_vendor_find_vendor_ie() fails to properly validate the length of the Information Element before passing it to other functions that read data at fixed offsets, leading to a heap out-of-bounds read of up to 9 bytes. Exploitation does not require authentication, association, or user interaction.

Users are advised to upgrade to Morse Micro HaLowLink 2 software version 2.11.12 or later. Customers using the morse.ko driver in their own Linux integrations should treat their integration as affected if it corresponds to a Morse Micro driver release prior to 2.11.12. Patched source can be obtained by contacting Morse Micro's security team.