CVE-2026-7763— Heap buffer overflow in morse.ko TIM IE processing

Heap buffer overflow in morse.ko TIM IE processing

A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. The function morse_page_slicing_process_tim_element() in page_slicing.c derives the TIM bitmap length directly from a received IE field without validating it against the fixed-size destination buffer before passing it to memset and memcpy operations, allowing up to 252 bytes of attacker-controlled data to be written beyond the buffer boundary. Because beacons are broadcast frames processed during passive scanning, no authentication, association, or user interaction is required.

N/A

N/A

Morse Micro HaLowLink 安全漏洞

Morse Micro HaLowLink是Morse Micro公司的一系列长距离无线网关设备。 Morse Micro HaLowLink 2 2.11.13之前版本存在安全漏洞，该漏洞源于morse.ko HaLow Wi-Fi内核驱动程序中morse_page_slicing_process_tim_element()函数从接收的IE字段直接派生TIM位图长度，未针对固定大小目标缓冲区进行验证，可能导致未经身份验证的攻击者通过特制802.11ah信标帧造成拒绝服务或远程代码执行。

N/A

N/A