Security readout for executives and security teams
Plain-English summary
This is a Linux kernel flaw in ARP packet creation. A low-privileged local user may be able to trigger memory corruption with severe confidentiality, integrity, and availability impact. The public bundle shows upstream stable fixes, but does not show active exploitation or distribution-specific package status.
Executive priority
Treat as high priority for Linux fleets, especially shared or multi-tenant systems. The issue is not shown as remotely exploitable, but the impact rating is severe once a low-privileged local attacker has code execution.
Technical view
arp_create() assumed dev_hard_header() would not change skb->head. The fix moves initialization of the ARP pointer until after dev_hard_header(), avoiding use of a pointer based on stale packet-buffer state. CVSS 3.1 is 7.8: local, low complexity, low privileges, no user interaction, high CIA impact.
Likely exposure
Exposure likely affects Linux systems running kernel builds that include the broken ARP behavior before the referenced stable fixes. Distribution package impact is not proven by the bundle; vulnerability managers should map vendor kernels to the upstream commits and fixed stable versions listed.
Exploitation context
The provided data does not cite KEV listing or active exploitation. The CVSS vector is local with low privileges, so risk is higher on shared servers, container hosts, developer workstations, and systems where untrusted users can execute code.
Researcher notes
The source bundle identifies a specific kernel ARP buffer-pointer assumption fixed by moving pointer initialization after dev_hard_header(). It does not provide a CWE, exploit details, affected distribution packages, or evidence of exploitation. Validate exposure through kernel commit ancestry and vendor backport metadata.
Mitigation direction
- Apply Linux vendor kernel updates that include the referenced upstream stable fixes.
- Reboot systems into the corrected kernel after patching.
- Prioritize shared, multi-user, and container-host Linux systems.
- If packages are unavailable, follow distribution guidance for backports or temporary controls.
- Limit untrusted local shell access where patching is delayed.
Validation and detection
- Inventory running Linux kernel versions across servers, VMs, and container hosts.
- Map installed distro kernels to the referenced upstream stable commits.
- Confirm systems booted into the patched kernel after updates.
- Check vendor advisories for package names, backport status, and reboot requirements.
- Monitor authoritative sources for any later exploitation reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-22988 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5eCVE reference, Linux
- https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0aCVE reference, Linux
- https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1CVE reference, Linux
- https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226CVE reference, Linux
- https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128faCVE reference, Linux
- https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3CVE reference, Linux
- https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.