{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22988", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.937Z", "datePublished": "2026-01-23T15:24:09.756Z", "dateUpdated": "2026-05-11T21:57:49.827Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:57:49.827Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: do not assume dev_hard_header() does not change skb->head\n\narp_create() is the only dev_hard_header() caller\nmaking assumption about skb->head being unchanged.\n\nA recent commit broke this assumption.\n\nInitialize @arp pointer after dev_hard_header() call."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/arp.c"], "versions": [{"version": "17e7386234f740f3e7d5e58a47b5847ea34c3bc2", "lessThan": "e432dbff342b95fe44645f9a90fcf333c80f4b5e", "status": "affected", "versionType": "git"}, {"version": "41a1a3140aff295dee8063906f70a514548105e8", "lessThan": "393525dee5c39acff8d6705275d7fcaabcfb7f0a", "status": "affected", "versionType": "git"}, {"version": "adee129db814474f2f81207bd182bf343832a52e", "lessThan": "70bddc16491ef4681f3569b3a2c80309a3edcdd1", "status": "affected", "versionType": "git"}, {"version": "1717357007db150c2d703f13f5695460e960f26c", "lessThan": "029935507d0af6553c45380fbf6feecf756fd226", "status": "affected", "versionType": "git"}, {"version": "5fe210533e3459197eabfdbf97327dacbdc04d60", "lessThan": "dd6ccec088adff4bdf33e2b2dd102df20a7128fa", "status": "affected", "versionType": "git"}, {"version": "91a2b25be07ce1a7549ceebbe82017551d2eec92", "lessThan": "949647e7771a4a01963fe953a96d81fba7acecf3", "status": "affected", "versionType": "git"}, {"version": "db5b4e39c4e63700c68a7e65fc4e1f1375273476", "lessThan": "c92510f5e3f82ba11c95991824a41e59a9c5ed81", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/arp.c"], "versions": [{"version": "6.1.160", "lessThan": "6.1.161", "status": "affected", "versionType": "semver"}, {"version": "6.6.120", "lessThan": "6.6.121", "status": "affected", "versionType": "semver"}, {"version": "6.12.64", "lessThan": "6.12.66", "status": "affected", "versionType": "semver"}, {"version": "6.18.4", "lessThan": "6.18.6", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.160", "versionEndExcluding": "6.1.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.120", "versionEndExcluding": "6.6.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.64", "versionEndExcluding": "6.12.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.4", "versionEndExcluding": "6.18.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e"}, {"url": "https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a"}, {"url": "https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1"}, {"url": "https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226"}, {"url": "https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa"}, {"url": "https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3"}, {"url": "https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81"}], "title": "arp: do not assume dev_hard_header() does not change skb->head", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E24038E7-22A7-43B5-8E72-1C262445BB8A", "versionEndExcluding": "6.12.66", "versionStartIncluding": "6.12.64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "27849DC4-2BBE-4536-8F33-2616A53ACA55", "versionEndExcluding": "6.18.6", "versionStartIncluding": "6.18.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.160:*:*:*:*:*:*:*", "matchCriteriaId": "24FE16BE-5350-467E-993C-FF2A07CBB376", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.6.120:*:*:*:*:*:*:*", "matchCriteriaId": "E4EF61BE-4718-4CD4-89DC-C7E24C2FE0B7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: do not assume dev_hard_header() does not change skb->head\n\narp_create() is the only dev_hard_header() caller\nmaking assumption about skb->head being unchanged.\n\nA recent commit broke this assumption.\n\nInitialize @arp pointer after dev_hard_header() call."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\narp: no asumir que dev_hard_header() no cambia skb->head\n\narp_create() es el \u00fanico llamador de dev_hard_header() que asume que skb->head permanece sin cambios.\n\nUn commit reciente dej\u00f3 de realizar esta suposici\u00f3n.\n\nInicializar el puntero @arp despu\u00e9s de la llamada a dev_hard_header()."}], "id": "CVE-2026-22988", "lastModified": "2026-04-27T14:16:27.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-23T16:15:54.860", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: arp: do not assume dev_hard_header() does not change skb->head", "id": "2432375", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432375"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-22988", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22988\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22988\nhttps://lore.kernel.org/linux-cve-announce/2026012350-CVE-2026-22988-1ee5@gregkh/T"], "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-28T22:27:56.526308+00:00", "value": {"mitigation_remediation": ["Apply the latest stable kernel update that includes the security fix", "Reboot the system to load the applied kernel", "Test ARP handling by sending traffic and reviewing system logs for related errors"], "summary": {"action": "Patch Kernel", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Linux kernel releases 6.1.160, 6.6.120, 6.19 rc4, and other 6.x versions that have not yet adopted the fix are affected. Any distribution embedding the upstream kernel without the patch remains vulnerable.", "description_and_impact": "In the Linux kernel a recent change caused dev_hard_header() to modify skb->head, breaking the assumption in arp_create() that the head remains unchanged. The consequence is that processing ARP packets could corrupt kernel memory and crash the kernel, resulting in a denial of service. Based on the description it is inferred that an attacker able to send crafted ARP packets could trigger this fault.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.8, indicating high severity, and an EPSS score below 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The risk is primarily local to the machine receiving the ARP packet; a network adversary who can inject crafted ARP traffic can force a kernel crash, interrupting services. No public exploit is known, but the potential for memory corruption means the issue should be remediated promptly."}}}}, "created": "2026-04-18T19:00:08.042013+00:00", "updated": "2026-04-28T22:30:41.637071+00:00", "vendors": []}