CVE-2026-7764: HaLow Wi-Fi Kernel Driver Out-of-Bounds Read & DoS

Technical summary

CVE-2026-7764 is an out-of-bounds read in morse.ko, the HaLow (802.11ah) Wi-Fi kernel driver used in Morse Micro HaLowLink 2 devices. The function morse_vendor_find_vendor_ie() retrieves a Vendor Information Element (IE) from a received frame but performs only a minimal length check (IE > 3 bytes). When this IE is passed to morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info(), these functions read at fixed offsets without confirming the IE is large enough. An attacker crafting a beacon or probe response with an undersized IE can trigger a read up to 9 bytes beyond the allocated buffer on the kernel heap. This results in either information disclosure or a kernel panic (oops).

Business impact

Organizations deploying Morse Micro HaLowLink 2 devices in IoT or industrial settings face two immediate risks. First, attackers can remotely crash devices, disrupting critical applications without authentication. Second, heap memory leaks could expose sensitive kernel data or configuration information. The low barrier to entry (proximity and radio transmission) combined with the lack of authentication requirements means any device within range is potentially vulnerable. For deployments in security-sensitive environments, this poses operational continuity and confidentiality risks.

Affected systems

Morse Micro HaLowLink 2 devices running firmware versions prior to 2.11.12 are vulnerable. The affected components are the halowlink_2 hardware platform and its associated halowlink_2_firmware. HaLow (802.11ah) is a long-range, low-power Wi-Fi standard commonly used in smart grid, agricultural IoT, and industrial control applications. Organizations should inventory any HaLow devices in their infrastructure and verify firmware version.

Exploitability

Exploitability is straightforward. An attacker requires only radio proximity (within HaLow range, typically several kilometers) and the ability to craft and transmit malformed 802.11ah frames—feasible with commodity software-defined radio tools. No authentication, association, or user interaction is required. The kernel driver processes incoming frames unconditionally, making every HaLowLink 2 device a potential target. The relatively high barrier is geographic proximity rather than technical complexity. Public exploit code is not yet observed, but the vulnerability details are clear enough that development would be low-effort for a motivated threat actor.

Remediation

Upgrade HaLowLink 2 firmware to version 2.11.12 or later. This patch implements proper length validation in morse_vendor_find_vendor_ie() to ensure that incoming Vendor Information Elements meet the expected structure size before data is read from them. Verify the patch version against Morse Micro's official advisory and release notes. Organizations without immediate patching capability should consider temporarily isolating affected devices or restricting radio access to trusted networks.

Patch guidance

Update HaLowLink 2 devices to firmware version 2.11.12 or later. Consult Morse Micro's official firmware distribution channel or your device manufacturer's support portal for release packages and upgrade procedures. Firmware updates typically require device reboot; coordinate with operational teams to minimize downtime. After patching, validate that devices have successfully upgraded by checking firmware version through the device management interface. Establish a change control process to prevent accidental downgrade to vulnerable versions.

Detection guidance

Network detection is limited because the attack involves crafted wireless frames at the physical layer. Endpoint-focused monitoring should track kernel panic messages or unexpected device reboots correlated with unusual Wi-Fi activity. If available, enable driver-level or wireless diagnostics logging to identify malformed IE reception. Host-based memory sanitizers or kernel address space layout randomization (KASLR) mitigations may help contain the impact. Organizations without direct visibility into device internals should rely on firmware patching and network access controls (e.g., Wi-Fi SSID filtering or geofencing).

Why prioritize this

Although CVSS 6.8 (Medium) reflects limited scope and local vector constraints, the real-world risk is elevated for organizations with HaLow infrastructure. The lack of authentication combined with remote exploitability via radio transmission means attackers can cause denial of service with minimal barriers. Heap memory disclosure, while limited to ~9 bytes, could expose kernel pointers or configuration secrets. For critical infrastructure or industrial IoT deployments, a single compromised device can trigger cascading failures. Prioritize patching if HaLowLink 2 devices operate in production environments; deprioritize if devices are isolated or infrequently deployed.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects a Medium severity because the attack vector is local (proximity-based radio), scope is unchanged, and impact is partial (confidentiality and availability, not integrity). However, this score may underweight the operational risk for mission-critical IoT and industrial applications. The lack of authentication and the feasibility of remote radio exploitation elevate practical risk beyond the numeric score. Consider raising internal risk ratings for devices in high-availability or safety-critical deployments.

Frequently asked questions