CVE-2026-22988

Vulnerability

In the Linux kernel's ARP implementation, the arp_create() function assumed that dev_hard_header() would not modify the skb->head pointer. A recent change to dev_hard_header() broke this assumption, causing the arp pointer (struct arphdr *) pointer, which was set before the call, to become stale if skb->head` was reallocated. This leads to a use-after-free or memory corruption when the stale pointer is dereferenced [1][2][3].

Exploitation

An attacker would need to trigger ARP packet creation in a context where dev_hard_header() causes a reallocation of the skb headroom. This could be achieved by sending crafted network traffic that forces the kernel to generate an ARP reply or request, potentially from a local network position. No special privileges are required beyond the ability to send packets to the target system [1][2].

Impact

Successful exploitation could allow an attacker to corrupt kernel memory, leading to a denial of service (system crash) or potentially arbitrary code execution with kernel privileges. The vulnerability is rated High with a CVSS v3 score of 7.8, indicating significant impact on confidentiality, integrity, and availability [1][2][3].

Mitigation

The fix is included in the Linux kernel stable updates. Users should apply the latest kernel patches from their distribution. The commit identifiers are 393525dee5c3, 949647e7771a, and 029935507d0a [1][2][3]. No workaround is available; patching is required.