BaseFortify

Publication date: 2026-01-23

Last updated on: 2026-04-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after dev_hard_header() call.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-23

Last Modified

2026-04-27

Generated

2026-07-06

AI Q&A

2026-01-23

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22988

EUVD

EUVD-2026-4299

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.19
linux	linux_kernel	From 6.18.4 (inc) to 6.18.6 (exc)
linux	linux_kernel	From 6.12.64 (inc) to 6.12.66 (exc)
linux	linux_kernel	6.1.160
linux	linux_kernel	6.6.120

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the Linux kernel's ARP implementation where the function arp_create() incorrectly assumes that the dev_hard_header() function does not modify the skb->head pointer. A recent code change broke this assumption, potentially leading to incorrect behavior. The fix was to initialize the arp pointer after the dev_hard_header() call to avoid relying on the unchanged skb->head.

Impact Analysis

The vulnerability could cause incorrect handling of ARP packets in the Linux kernel due to the assumption that skb->head remains unchanged after dev_hard_header() is called. This might lead to unexpected behavior or instability in network packet processing, potentially affecting network communication reliability.

Hi! I’m here to help you understand CVE-2026-22988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70