CVE-2026-7762 Overview
CVE-2026-7762 is a heap-based buffer overflow in the dot11ah.ko HaLow Wi-Fi kernel driver shipped with Morse Micro HaLowLink 2 software versions prior to 2.11.13. The flaw resides in morse_dot11ah_find_s1g_caps_for_bssid(), which copies an attacker-controlled Information Element (IE) into a fixed 15-byte buffer without bounds checking. An unauthenticated attacker within radio range can transmit a crafted 802.11ah beacon or probe response frame to trigger a kernel panic or potentially achieve remote code execution. Exploitation requires no authentication, association, or user interaction, as the vulnerable code path executes during normal Wi-Fi scanning.
Critical Impact
Unauthenticated radio-range attackers can overflow up to 240 bytes of attacker-controlled data into kernel heap memory, enabling denial of service or kernel-mode remote code execution.
Affected Products
- Morse Micro HaLowLink 2 software versions prior to 2.11.13
- dot11ah.ko HaLow Wi-Fi kernel driver
- 802.11ah (Wi-Fi HaLow) S1G client devices using affected firmware
Discovery Timeline
- 2026-06-05 - CVE-2026-7762 published to NVD
- 2026-06-05 - Last updated in NVD database
Technical Details for CVE-2026-7762
Vulnerability Analysis
The vulnerability resides in the morse_dot11ah_find_s1g_caps_for_bssid() function within the dot11ah.ko kernel module. The function parses S1G Capabilities Information Elements (IE element ID 0xD9) extracted from received 802.11ah management frames. The destination buffer is statically sized to 15 bytes, matching the expected length of a well-formed S1G Capabilities IE.
The parser uses the attacker-supplied IE length field directly as the size argument to memcpy(). Because the 802.11 IE length field is an 8-bit value, an attacker can specify any size from 0 to 255 bytes. Supplying a length greater than 15 produces a linear heap overflow of up to 240 bytes of attacker-controlled data into adjacent kernel allocations.
Root Cause
The root cause is missing input validation [CWE-122: Heap-based Buffer Overflow]. The driver trusts the length field embedded in an unauthenticated radio frame and omits a size check against the fixed destination buffer before invoking memcpy(). No sanity check enforces the protocol-defined maximum length of the S1G Capabilities element.
Attack Vector
The attack vector is adjacent radio range. An attacker broadcasts a malicious 802.11ah beacon or sends a probe response containing a malformed S1G Capabilities IE with element ID 0xD9 and a length byte greater than 15. Any vulnerable HaLowLink 2 device performing a passive or active scan parses the frame and triggers the overflow. No association, authentication, or user interaction is required, and the corruption occurs in kernel context.
No verified public proof-of-concept code is available. Refer to the Morse Micro Security Advisory for vendor technical details.
Detection Methods for CVE-2026-7762
Indicators of Compromise
- Unexpected kernel panics or oops messages referencing dot11ah.ko or morse_dot11ah_find_s1g_caps_for_bssid
- 802.11ah beacon or probe response frames containing an S1G Capabilities IE (element ID 0xD9) with a length field greater than 15
- HaLow client devices repeatedly rebooting during Wi-Fi scanning in the presence of unknown nearby transmitters
Detection Strategies
- Monitor kernel ring buffer output (dmesg, /var/log/kern.log) on HaLowLink 2 devices for crashes within the dot11ah module.
- Use a HaLow-capable spectrum monitor or tcpdump against a monitor-mode interface to capture 802.11ah management frames and inspect IE 0xD9 length values.
- Correlate device reboot events with proximity-based RF telemetry to identify possible radio-range exploitation attempts.
Monitoring Recommendations
- Forward HaLow device syslog and kernel logs to a centralized analytics platform for anomaly detection on driver crash signatures.
- Alert on repeated dot11ah module unload/load cycles, which can indicate exploitation attempts triggering watchdog recovery.
- Track firmware version inventory and flag any HaLowLink 2 device running a build earlier than 2.11.13.
How to Mitigate CVE-2026-7762
Immediate Actions Required
- Upgrade all Morse Micro HaLowLink 2 devices to software version 2.11.13 or later as published in the Morse Micro Security Advisory.
- Inventory all HaLow-enabled assets and identify devices running vulnerable dot11ah.ko builds.
- Restrict HaLow scanning to trusted RF environments until patching completes.
Patch Information
Morse Micro addressed the issue in HaLowLink 2 software release 2.11.13. The fix adds explicit length validation in morse_dot11ah_find_s1g_caps_for_bssid() so that S1G Capabilities IEs exceeding the 15-byte destination buffer are rejected before memcpy(). Apply the vendor-supplied firmware image through the documented update mechanism and verify the running version after reboot.
Workarounds
- Disable 802.11ah scanning on affected devices where operationally feasible until firmware can be updated.
- Operate vulnerable devices only within physically controlled RF environments to limit radio-range exposure.
- Deploy HaLow gateways in shielded enclosures or on isolated frequency channels to reduce attacker reachability.
# Verify installed HaLowLink 2 software version after upgrade
halowlink-cli system version
# Expected output: 2.11.13 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
