CVE-2026-22988
published 2026-01-23CVE-2026-22988: In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.12%
2.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
arp: do not assume dev_hard_header() does not change skb->head
arp_create() is the only dev_hard_header() caller
making assumption about skb->head being unchanged.
A recent commit broke this assumption.
Initialize @arp pointer after dev_hard_header() call.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.8-1 (forky) | linux 6.18.8-1 (forky) |
| linux | linux | >= 1717357007db150c2d703f13f5695460e960f26c < 029935507d0af6553c45380fbf6feecf756fd226 | 029935507d0af6553c45380fbf6feecf756fd226 |
| linux | linux | >= 17e7386234f740f3e7d5e58a47b5847ea34c3bc2 < e432dbff342b95fe44645f9a90fcf333c80f4b5e | e432dbff342b95fe44645f9a90fcf333c80f4b5e |
| linux | linux | >= 41a1a3140aff295dee8063906f70a514548105e8 < 393525dee5c39acff8d6705275d7fcaabcfb7f0a | 393525dee5c39acff8d6705275d7fcaabcfb7f0a |
| linux | linux | >= 5fe210533e3459197eabfdbf97327dacbdc04d60 < dd6ccec088adff4bdf33e2b2dd102df20a7128fa | dd6ccec088adff4bdf33e2b2dd102df20a7128fa |
| linux | linux | >= 6.1.160 < 6.1.161 | 6.1.161 |
| linux | linux | >= 6.12.64 < 6.12.66 | 6.12.66 |
| linux | linux | >= 6.18.4 < 6.18.6 | 6.18.6 |
| linux | linux | >= 6.6.120 < 6.6.121 | 6.6.121 |
| linux | linux | >= 91a2b25be07ce1a7549ceebbe82017551d2eec92 < 949647e7771a4a01963fe953a96d81fba7acecf3 | 949647e7771a4a01963fe953a96d81fba7acecf3 |
| linux | linux | >= adee129db814474f2f81207bd182bf343832a52e < 70bddc16491ef4681f3569b3a2c80309a3edcdd1 | 70bddc16491ef4681f3569b3a2c80309a3edcdd1 |
| linux | linux | >= db5b4e39c4e63700c68a7e65fc4e1f1375273476 < c92510f5e3f82ba11c95991824a41e59a9c5ed81 | c92510f5e3f82ba11c95991824a41e59a9c5ed81 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.18.8-1 | 6.18.8-1 |
| linux | linux_kernel | >= 6.12.64 < 6.12.66 | 6.12.66 |
| linux | linux_kernel | >= 6.18.4 < 6.18.6 | 6.18.6 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-22988: In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the
osv·2026-01-23·CVSS 5.5
CVE-2026-22988 [MEDIUM] CVE-2026-22988: In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the
In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after dev_hard_header() call.
GHSA
GHSA-5fwh-qcfv-38cc: In the Linux kernel, the following vulnerability has been resolved:
arp: do not assume dev_hard_header() does not change skb->head
arp_create() is t
ghsa_unreviewed·2026-01-23
CVE-2026-22988 [MEDIUM] GHSA-5fwh-qcfv-38cc: In the Linux kernel, the following vulnerability has been resolved:
arp: do not assume dev_hard_header() does not change skb->head
arp_create() is t
In the Linux kernel, the following vulnerability has been resolved:
arp: do not assume dev_hard_header() does not change skb->head
arp_create() is the only dev_hard_header() caller
making assumption about skb->head being unchanged.
A recent commit broke this assumption.
Initialize @arp pointer after dev_hard_header() call.
Red Hat
kernel: arp: do not assume dev_hard_header() does not change skb->head
vendor_redhat·2026-01-23·CVSS 5.5
CVE-2026-22988 [MEDIUM] CWE-825 kernel: arp: do not assume dev_hard_header() does not change skb->head
kernel: arp: do not assume dev_hard_header() does not change skb->head
In the Linux kernel, the following vulnerability has been resolved:
arp: do not assume dev_hard_header() does not change skb->head
arp_create() is the only dev_hard_header() caller
making assumption about skb->head being unchanged.
A recent commit broke this assumption.
Initialize @arp pointer after dev_hard_header() call.
A use-after-free vulnerability was found in the Linux kernel's ARP implementation. The arp_create() function initializes a pointer to the ARP header before calling dev_hard_header(), incorrectly assuming that skb->head will not change. A recent kernel change broke this assumption, causing the @arp pointer to reference stale memory after dev_hard_header() potentially reallocates the socket buffer.
S
Debian
CVE-2026-22988: linux - In the Linux kernel, the following vulnerability has been resolved: arp: do not...
vendor_debian·2026·CVSS 5.5
CVE-2026-22988 [MEDIUM] CVE-2026-22988: linux - In the Linux kernel, the following vulnerability has been resolved: arp: do not...
In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after dev_hard_header() call.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.18.8-1)
sid: resolved (fixed in 6.18.8-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0ahttps://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fahttps://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e
2026-01-23
Published