PT-2026-4488 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-04-27 · CVE-2026-22988

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel related to Address Resolution Protocol (ARP). The issue stems from an incorrect assumption within the arp create() function regarding the skb->head pointer after a call to dev hard header(). A recent code change invalidated this assumption. Specifically, the code did not properly initialize the @arp pointer after the dev hard header() function was called. This could potentially lead to unexpected behavior or system instability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-665

CWE-825

Related Identifiers

BDU:2026-07385

CVE-2026-22988

OPENSUSE-SU-2026:20287-1

SUSE-SU-2026:0447-1

SUSE-SU-2026:0472-1

SUSE-SU-2026:0473-1

SUSE-SU-2026:0587-1

SUSE-SU-2026:20477-1

SUSE-SU-2026:20498-1

SUSE-SU-2026:20555-1

SUSE-SU-2026:20599-1

SUSE-SU-2026:20615-1

SUSE-SU-2026:20845-1

SUSE-SU-2026:20876-1

Affected Products

Linux Kernel

References · 1759

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22988.json · Exploit
• https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226 · Patch
• https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0472-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22988 · Vendor Advisory
• https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:20845-1 · Vendor Advisory
• https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa · Patch
• https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:20498-1 · Vendor Advisory
• https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e · Patch
• https://osv.dev/vulnerability/CVE-2026-22988 · Vendor Advisory
• https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-22988 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0447-1 · Vendor Advisory