---
id: CVE-2026-7764
title: >-
  An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver
  in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an
  unauthenticated attacker within radio range to disclose a small amount of
  kernel heap m…
summary: >-
  An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver
  in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an
  unauthenticated attacker within radio range to disclose a small amount of
  kernel heap m…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cwe:
  - CWE-125
vendor: morsemicro
product: halowlink_2_firmware
affected:
  - halowlink_2_firmware < 2.11.12
patched:
  - halowlink_2_firmware 2.11.12
published: '2026-06-04'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-7764'
references:
  - url: 'https://www.morsemicro.com/security-advisories/MM-SA-2026-003'
    label: 4ac701fe-44e9-4bcd-9585-dd6449257611
tags:
  - nvd
epss: 0.0013
epssPercentile: 0.03028
ingestedAt: '2026-07-01T09:50:45.937Z'
---

## Overview

An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker within radio range to disclose a small amount of kernel heap memory or cause a Denial of Service (kernel oops/panic) via a crafted 802.11ah beacon or probe response frame containing a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate the IE length against the expected structure size before its result is passed to morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info(), which read at fixed offsets into the IE data. Because the length check only requires the IE to be longer than 3 bytes, an attacker can supply an undersized IE, causing a heap out-of-bounds read of up to 9 bytes. No authentication, association, or user interaction is required.

## Affected

- `halowlink_2_firmware < 2.11.12`

## Remediation

Upgrade past the affected range:

- `halowlink_2_firmware 2.11.12`