A heap-based buffer overflow exists in the dot11ah.ko HaLow Wi‑Fi kernel driver of Morse Micro HaLowLink 2. The vulnerability is triggered when the driver processes an 802.11ah beacon or probe‑response frame that contains a malformed S1G Capabilities Information Element with an excessively long length field. Exploiting this flaw allows an unauthenticated attacker within radio range to overwrite up to 240 bytes of adjacent kernel heap memory, potentially causing a kernel panic or enabling arbitrary code execution.

The affected product is Morse Micro HaLowLink 2 software versions earlier than 2.11.13. No other vendors or products are listed as impacted by this flaw.

Because the attack requires only the transmission of a crafted wireless frame and does not need any credentials or network access, the attack vector is wireless proximity. The CVSS and EPSS scores are not available, and the vulnerability is not listed in CISA’s KEV catalog, but the potential for denial of service or remote code execution on a kernel level makes the risk high for systems that expose a HaLow link. An attacker must be within radio range (~30 meters for 802.11ah) to deliver the payload, which reduces the overall likelihood of exploitation in the broader internet, though it remains a serious risk in shared or open wireless environments.