CVE-2026-7762: Heap buffer overflow in dot11ah.ko S1G Capabilities IE processing

Synopsis

A heap-based buffer overflow exists in the dot11ah.ko HaLow Wi-Fi kernel driver shipped with Morse Micro HaLowLink 2 software versions prior to 2.11.13. An unauthenticated attacker within radio range can trigger the flaw by broadcasting a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities IE, requiring no authentication, association, or user interaction. Successful exploitation crashes the kernel or achieves remote code execution on the affected host. A patched-image rebuild at version 2.11.13 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be within 802.11ah radio range of the target device, as the malicious frame is delivered over the wireless medium without any prior network association.

• AuthenticationNot required

  No credentials, association, or prior relationship with the target is needed; the vulnerability is triggered during passive scanning before any authentication handshake.

• Victim interactionNot required

  The target device requires no user action; normal background Wi-Fi scanning is sufficient to deliver the malicious frame to the vulnerable parsing code.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker is within radio range, with no race conditions or memory-layout dependencies required to trigger the overflow.

Blast Radius

• An attacker can write up to 240 bytes of attacker-controlled data past the 15-byte destination buffer into adjacent kernel heap memory, enabling reliable kernel panic and denial of service.
• With a suitable heap-layout primitive, the overflow allows an attacker to overwrite adjacent kernel objects and redirect execution flow, achieving remote code execution in kernel context.
• Kernel-level code execution grants full read access to all memory on the host, including credentials, session tokens, cryptographic keys, and any data held in kernel or user space.
• At the same kernel privilege level, an attacker can modify or destroy persisted data, load arbitrary kernel modules, and take complete control of the affected device.