Security readout for executives and security teams
Plain-English summary
A Linux kernel ARP packet-construction bug can leave code using an outdated packet-buffer pointer after a header-building routine moves the buffer. A local, low-privileged attacker may be able to cause serious confidentiality, integrity, or availability impact. Exact vulnerable release ranges are not clearly presented in the supplied bundle.
Executive priority
Treat this as high priority for shared Linux infrastructure or hosts permitting untrusted local execution. It is not described as remotely exploitable, and the bundle reports no KEV listing or active-exploitation evidence. Patch through expedited kernel maintenance after confirming vendor applicability; accelerate where local trust boundaries are weak.
Technical view
arp_create() initialized an ARP pointer before dev_hard_header(). A recent kernel change allowed that call to change skb->head, making the earlier pointer stale. The resolution initializes the pointer afterward. CVSS 3.1 is 7.8 (AV:L/AC:L/PR:L/UI:N), indicating local, low-complexity, low-privilege exploitation without user interaction and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to Linux systems containing the vulnerable change without the corresponding stable fix, particularly where untrusted users or workloads have local execution. The bundle lists kernel commits and versions with a default status of unaffected but does not clearly define vulnerable intervals. Distribution backports make version-only judgments unreliable.
Exploitation context
The CVSS vector requires local access with low privileges; it does not indicate remote exploitation or user interaction. The bundle states that this CVE is not in KEV and supplies no evidence of active exploitation or a public exploit. Practical exploitability beyond the CVSS assessment remains unconfirmed.
Researcher notes
The record describes pointer invalidation caused by skb->head relocation but assigns no CWE and does not clearly provide vulnerable release intervals. Stable commit links document the correction across maintained branches. Exploitability beyond the local CVSS vector and high potential impacts remains unconfirmed from the supplied evidence.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced ARP fix, then reboot into the updated kernel.
- Confirm distribution advisories and backport status; do not rely solely on upstream version numbers.
- Restrict untrusted local access and workload execution until affected systems are patched.
- Prioritize shared hosts and systems that execute untrusted code.
Validation and detection
- Inventory running kernel builds, including distribution patch levels and custom kernels.
- Verify the running kernel contains the referenced ARP pointer-initialization fix.
- Map custom kernels against the referenced stable commits and their ancestry.
- After updating, confirm systems booted the intended patched kernel.
- Review vendor advisories for an authoritative affected-version determination.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-22988 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5eCVE reference, Linux
- https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0aCVE reference, Linux
- https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1CVE reference, Linux
- https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226CVE reference, Linux
- https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128faCVE reference, Linux
- https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3CVE reference, Linux
- https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.