CVE-2026-22988: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22988 is a memory corruption vulnerability in the Linux kernel's ARP implementation, specifically in the arp_create() function. The function incorrectly assumes that dev_hard_header() does not modify skb->head; a recent kernel commit broke this assumption, causing the ARP pointer to reference invalid memory after the call. Affected kernel versions include 6.1.160, 6.6.120, 6.12.64–6.12.65, 6.18.4–6.18.5, and 6.19-rc4. The vulnerability was published on January 23, 2026. NIST NVD assigns a CVSS v3.1 base score of 5.5 (Medium), while the kernel.org CNA assigns 7.8 (High) (Red Hat Advisory, Feedly).

The root cause is an invalid pointer dereference resulting from a broken assumption in arp_create(): the @arp pointer was initialized before the dev_hard_header() call, but a recent commit caused dev_hard_header() to reallocate or modify skb->head, invalidating the previously stored pointer. The fix moves the initialization of the @arp pointer to after the dev_hard_header() call, ensuring it references valid memory. This is classified under CWE as insufficient information (NVD-CWE-noinfo), though the behavior is consistent with a use-after-reallocation or stale pointer dereference pattern. The vulnerability is locally exploitable by a low-privileged user who can trigger ARP packet creation on an affected system (Red Hat Advisory, Feedly).

A local attacker with low privileges can exploit this vulnerability to cause a kernel crash or hang, resulting in a denial of service. Depending on the specific memory layout at the time of exploitation, there is also potential for information disclosure or privilege escalation, as assessed by the kernel.org CNA's higher CVSS score of 7.8 (High). The vulnerability is confined to the local system and does not directly enable remote exploitation or lateral movement (Feedly).

Upgrade the Linux kernel to a patched version: 6.1.161 or later (for 6.1.x branch), 6.6.121 or later (for 6.6.x branch), 6.12.66 or later (for 6.12.x branch), 6.18.6 or later (for 6.18.x branch), or 6.19-rc5 or later. Patches are available as commits on kernel.org stable branches. As a secondary mitigation, restrict local user privileges and limit access to network interfaces where possible to reduce exploitation opportunities (Feedly, Red Hat Advisory).

Red Hat tracked the vulnerability via Bugzilla (bug #2432375) and published a CVE advisory. Oracle also issued an enterprise kernel advisory referencing this CVE. No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability database entries (Red Hat Advisory, Oracle Advisory).