FKIE_CVE-2026-22988

Vulnerability from fkie_nvd - Published: 2026-01-23 16:15 - Updated: 2026-06-17 10:20
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after dev_hard_header() call.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128faPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5ePatch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 6.1.160
linux linux_kernel 6.6.120
linux linux_kernel 6.19
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/arp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e432dbff342b95fe44645f9a90fcf333c80f4b5e",
              "status": "affected",
              "version": "17e7386234f740f3e7d5e58a47b5847ea34c3bc2",
              "versionType": "git"
            },
            {
              "lessThan": "393525dee5c39acff8d6705275d7fcaabcfb7f0a",
              "status": "affected",
              "version": "41a1a3140aff295dee8063906f70a514548105e8",
              "versionType": "git"
            },
            {
              "lessThan": "70bddc16491ef4681f3569b3a2c80309a3edcdd1",
              "status": "affected",
              "version": "adee129db814474f2f81207bd182bf343832a52e",
              "versionType": "git"
            },
            {
              "lessThan": "029935507d0af6553c45380fbf6feecf756fd226",
              "status": "affected",
              "version": "1717357007db150c2d703f13f5695460e960f26c",
              "versionType": "git"
            },
            {
              "lessThan": "dd6ccec088adff4bdf33e2b2dd102df20a7128fa",
              "status": "affected",
              "version": "5fe210533e3459197eabfdbf97327dacbdc04d60",
              "versionType": "git"
            },
            {
              "lessThan": "949647e7771a4a01963fe953a96d81fba7acecf3",
              "status": "affected",
              "version": "91a2b25be07ce1a7549ceebbe82017551d2eec92",
              "versionType": "git"
            },
            {
              "lessThan": "c92510f5e3f82ba11c95991824a41e59a9c5ed81",
              "status": "affected",
              "version": "db5b4e39c4e63700c68a7e65fc4e1f1375273476",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/arp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.161",
              "status": "affected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.121",
              "status": "affected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.66",
              "status": "affected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.6",
              "status": "affected",
              "version": "6.18.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E24038E7-22A7-43B5-8E72-1C262445BB8A",
              "versionEndExcluding": "6.12.66",
              "versionStartIncluding": "6.12.64",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "27849DC4-2BBE-4536-8F33-2616A53ACA55",
              "versionEndExcluding": "6.18.6",
              "versionStartIncluding": "6.18.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.1.160:*:*:*:*:*:*:*",
              "matchCriteriaId": "24FE16BE-5350-467E-993C-FF2A07CBB376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.6.120:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4EF61BE-4718-4CD4-89DC-C7E24C2FE0B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: do not assume dev_hard_header() does not change skb-\u003ehead\n\narp_create() is the only dev_hard_header() caller\nmaking assumption about skb-\u003ehead being unchanged.\n\nA recent commit broke this assumption.\n\nInitialize @arp pointer after dev_hard_header() call."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\narp: no asumir que dev_hard_header() no cambia skb-\u0026gt;head\n\narp_create() es el \u00fanico llamador de dev_hard_header() que asume que skb-\u0026gt;head permanece sin cambios.\n\nUn commit reciente dej\u00f3 de realizar esta suposici\u00f3n.\n\nInicializar el puntero @arp despu\u00e9s de la llamada a dev_hard_header()."
    }
  ],
  "id": "CVE-2026-22988",
  "lastModified": "2026-06-17T10:20:39.573",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-01-23T16:15:54.860",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.