CVE-2026-7763 Overview
CVE-2026-7763 is a heap-based buffer overflow in the morse.ko HaLow Wi-Fi kernel driver shipped with Morse Micro HaLowLink 2 software versions prior to 2.11.13. The flaw resides in morse_page_slicing_process_tim_element() in page_slicing.c, which copies attacker-controlled data from a malformed Traffic Indication Map (TIM) Information Element into a fixed-size kernel buffer. An unauthenticated attacker within radio range can transmit a crafted 802.11ah beacon frame to trigger the overflow during passive scanning. Successful exploitation yields a kernel panic or potential remote code execution in kernel context.
Critical Impact
An adjacent radio attacker can corrupt kernel memory on any HaLow device performing passive scanning, with no authentication, association, or user interaction required.
Affected Products
- Morse Micro HaLowLink 2 software versions prior to 2.11.13
- The morse.ko HaLow Wi-Fi kernel driver
- Devices integrating Morse Micro 802.11ah chipsets running affected firmware
Discovery Timeline
- 2026-06-05 - CVE-2026-7763 published to NVD
- 2026-06-05 - Last updated in NVD database
Technical Details for CVE-2026-7763
Vulnerability Analysis
The vulnerability is a heap-based buffer overflow [CWE-122] in the kernel-mode HaLow Wi-Fi driver. The function morse_page_slicing_process_tim_element() parses the TIM Information Element of an incoming 802.11ah beacon frame. The driver reads the TIM bitmap length directly from the received IE field and passes it to memset and memcpy operations against a fixed-size destination buffer on the kernel heap. Up to 252 bytes of attacker-controlled data can be written past the buffer boundary, corrupting adjacent heap objects within the kernel address space.
Root Cause
The driver omits a length validation between the IE-supplied bitmap length and the static size of the destination buffer. Because the controlling field originates from an untrusted radio frame, an attacker fully controls both the overflow length and the data written. The result is a classic missing bounds check on attacker-tainted input prior to memory copy primitives in kernel space.
Attack Vector
Beacon frames are broadcast and processed during passive scanning, so no association, key exchange, or user action is needed. An attacker positioned within 802.11ah radio range transmits a malformed beacon containing a crafted TIM Information Element. The receiving driver parses the beacon while scanning, invokes the vulnerable function, and overflows the kernel heap. The immediate effect is a kernel panic causing denial of service, and with shaped heap state the primitive can be steered toward remote code execution at kernel privilege.
No public proof-of-concept exploit is available. The vulnerability mechanism is documented in the Morse Micro Security Advisory.
Detection Methods for CVE-2026-7763
Indicators of Compromise
- Unexpected kernel panics or driver crashes referencing morse.ko or morse_page_slicing_process_tim_element in stack traces.
- Repeated 802.11ah beacon frames from unknown BSSIDs containing oversized TIM Information Elements during passive scans.
- Sudden loss of HaLow connectivity across multiple devices in the same radio coverage area.
Detection Strategies
- Inspect kernel ring buffer (dmesg) and /var/log/kern.log for oops or panic signatures originating from the morse driver.
- Capture 802.11ah air traffic and flag beacon frames where the TIM IE length exceeds the protocol-expected bitmap size.
- Correlate device reboots with proximity to unrecognized 802.11ah transmitters using time-aligned wireless telemetry.
Monitoring Recommendations
- Forward kernel logs and crash dumps from HaLow gateways to a centralized log platform for anomaly review.
- Alert on repeated unexpected restarts of HaLow interfaces or the morse kernel module.
- Track firmware and driver versions across fleet inventory to identify devices still running builds prior to 2.11.13.
How to Mitigate CVE-2026-7763
Immediate Actions Required
- Upgrade all Morse Micro HaLowLink 2 deployments to software version 2.11.13 or later.
- Inventory devices using the morse.ko driver and prioritize patching units exposed to untrusted radio environments.
- Restrict physical and radio access to HaLow devices until the patch is applied.
Patch Information
Morse Micro has released HaLowLink 2 software version 2.11.13, which adds validation of the TIM bitmap length against the destination buffer size in morse_page_slicing_process_tim_element() before invoking memset and memcpy. Refer to the Morse Micro Security Advisory MM-SA-2026-001 for the official fix, release notes, and upgrade procedure.
Workarounds
- Disable passive scanning on affected HaLow interfaces where operationally feasible to prevent processing of unsolicited beacons.
- Power down or isolate HaLow radios in environments where untrusted 802.11ah transmitters may be present until the firmware update is deployed.
- Constrain HaLow operation to controlled channels and locations to reduce the attack surface for adjacent radio adversaries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
