Vulnerability-Lookup

BDU:2026-07385 (CVE-2026-22988)

Vulnerability from fstec – Published: 2026-05-28 – Updated: 2026-06-19 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции arp_create() в модуле net/ipv4/arp.c реализации протокола IPv4 ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость функции arp_create() в модуле net/ipv4/arp.c реализации протокола IPv4 ядра операционной системы Linux связана с разыменованием указателя с истекшим сроком действия. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

7.8 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation, Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-665 - Неверная инициализация
CWE-825 - Разыменование указателя с истекшим сроком действия

Aliases

CVE-2026-22988

References

15 references

URL
https://git.kernel.org/linus/c92510f5e3f82ba11c95991824a41e59a9c5ed81
https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226
https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a
https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1
https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3
https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81
https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa
https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e
https://github.com/torvalds/linux/commit/949647e7771a4a01963fe953a96d81fba7acecf3
https://nvd.nist.gov/vuln/detail/CVE-2026-22988
https://security-tracker.debian.org/tracker/CVE-2026-22988
https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47
https://www.cve.org/CVERecord?id=CVE-2026-22988
https://www.suse.com/security/cve/CVE-2026-22988.html
https://altsp.su/obnovleniya-bezopasnosti/

Impacted products

7 products from 4 vendors

Vendors

ООО «РусБИТех-Астра», АО «ИВК», Novell Inc., Сообщество свободного программного обеспечения

Products

Astra Linux Special Edition (запись в едином реестре российских программ №369), АЛЬТ СП 10, Suse Linux Enterprise Server, SUSE Linux Enterprise Server for SAP Applications, SUSE Linux Micro, OpenSUSE Leap, Linux

Versions

4.7 (Astra Linux Special Edition), - (АЛЬТ СП 10), 12 SP5-LTSS (Suse Linux Enterprise Server), 15 SP7 (Suse Linux Enterprise Server), 15 SP7 (SUSE Linux Enterprise Server for SAP Applications), 6.0 (SUSE Linux Micro), 6.1 (SUSE Linux Micro), 16.0 (SUSE Linux Enterprise Server for SAP Applications), 16.0 (Suse Linux Enterprise Server), 16.0 (OpenSUSE Leap), 6.2 (SUSE Linux Micro), от 6.1.160 до 6.1.161 (Linux), от 6.12.64 до 6.12.66 (Linux), от 6.18.4 до 6.18.6 (Linux), от 6.6.120 до 6.6.121 (Linux)

Product types

Operating system, Application software

Platforms

АО «ИВК» АЛЬТ СП 10 -, Novell Inc. Suse Linux Enterprise Server 12 SP5-LTSS, Novell Inc. Suse Linux Enterprise Server 15 SP7, Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP7, Novell Inc. SUSE Linux Micro 6.0, Novell Inc. SUSE Linux Micro 6.1, Novell Inc. SUSE Linux Enterprise Server for SAP Applications 16.0, Novell Inc. Suse Linux Enterprise Server 16.0, Novell Inc. OpenSUSE Leap 16.0, Novell Inc. SUSE Linux Micro 6.2, Сообщество свободного программного обеспечения Linux 6.1.160, Сообщество свободного программного обеспечения Linux 6.6.120, Сообщество свободного программного обеспечения Linux от 6.12.64 до 6.12.65 включительно, Сообщество свободного программного обеспечения Linux от 6.18.4 до 6.18.5 включительно

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1 https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226 https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3 https://git.kernel.org/linus/c92510f5e3f82ba11c95991824a41e59a9c5ed81 Для программных продуктов Novell Inc.: https://www.suse.com/security/cve/CVE-2026-22988.html Для ОС Astra Linux: - обновить пакет linux-5.10 до 5.10.142-1.astra6+ci24 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 - обновить пакет linux-6.1 до 6.1.161-1.astra1+ci17 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 Для ОС АЛЬТ СП 10: установка обновления из публичного репозитория программного средства: https://altsp.su/obnovleniya-bezopasnosti/

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb, \u0410\u041e \u00ab\u0418\u0412\u041a\u00bb, Novell Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "4.7 (Astra Linux Special Edition), - (\u0410\u041b\u042c\u0422 \u0421\u041f 10), 12 SP5-LTSS (Suse Linux Enterprise Server), 15 SP7 (Suse Linux Enterprise Server), 15 SP7 (SUSE Linux Enterprise Server for SAP Applications), 6.0 (SUSE Linux Micro), 6.1 (SUSE Linux Micro), 16.0 (SUSE Linux Enterprise Server for SAP Applications), 16.0 (Suse Linux Enterprise Server), 16.0 (OpenSUSE Leap), 6.2 (SUSE Linux Micro), \u043e\u0442 6.1.160 \u0434\u043e 6.1.161 (Linux), \u043e\u0442 6.12.64 \u0434\u043e 6.12.66 (Linux), \u043e\u0442 6.18.4 \u0434\u043e 6.18.6 (Linux), \u043e\u0442 6.6.120 \u0434\u043e 6.6.121 (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\n\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e\nhttps://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a\nhttps://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1\nhttps://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226\nhttps://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa\nhttps://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3\nhttps://git.kernel.org/linus/c92510f5e3f82ba11c95991824a41e59a9c5ed81\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://www.suse.com/security/cve/CVE-2026-22988.html\n\n\u0414\u043b\u044f \u041e\u0421 Astra Linux:\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 linux-5.10 \u0434\u043e 5.10.142-1.astra6+ci24 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47\n- \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442 linux-6.1 \u0434\u043e 6.1.161-1.astra1+ci17 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47\n\n\u0414\u043b\u044f \u041e\u0421 \u0410\u041b\u042c\u0422 \u0421\u041f 10: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430: https://altsp.su/obnovleniya-bezopasnosti/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "07.01.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "19.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.05.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-07385",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-22988",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369), \u0410\u041b\u042c\u0422 \u0421\u041f 10, Suse Linux Enterprise Server, SUSE Linux Enterprise Server for SAP Applications, SUSE Linux Micro, OpenSUSE Leap, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u0410\u041e \u00ab\u0418\u0412\u041a\u00bb \u0410\u041b\u042c\u0422 \u0421\u041f 10 - , Novell Inc. Suse Linux Enterprise Server 12 SP5-LTSS , Novell Inc. Suse Linux Enterprise Server 15 SP7 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP7 , Novell Inc. SUSE Linux Micro 6.0 , Novell Inc. SUSE Linux Micro 6.1 , Novell Inc. SUSE Linux Enterprise Server for SAP Applications 16.0 , Novell Inc. Suse Linux Enterprise Server 16.0 , Novell Inc. OpenSUSE Leap 16.0 , Novell Inc. SUSE Linux Micro 6.2 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux 6.1.160 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux 6.6.120 , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.12.64 \u0434\u043e 6.12.65 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.18.4 \u0434\u043e 6.18.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 arp_create() \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 net/ipv4/arp.c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv4 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u0430\u044f \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f (CWE-665), \u0420\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u0441 \u0438\u0441\u0442\u0435\u043a\u0448\u0438\u043c \u0441\u0440\u043e\u043a\u043e\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f (CWE-825)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 arp_create() \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 net/ipv4/arp.c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv4 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u0441 \u0438\u0441\u0442\u0435\u043a\u0448\u0438\u043c \u0441\u0440\u043e\u043a\u043e\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/linus/c92510f5e3f82ba11c95991824a41e59a9c5ed81\nhttps://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226\nhttps://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a\nhttps://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1\nhttps://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3\nhttps://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81\nhttps://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa\nhttps://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e\nhttps://github.com/torvalds/linux/commit/949647e7771a4a01963fe953a96d81fba7acecf3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22988\nhttps://security-tracker.debian.org/tracker/CVE-2026-22988\nhttps://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47\nhttps://www.cve.org/CVERecord?id=CVE-2026-22988\nhttps://www.suse.com/security/cve/CVE-2026-22988.html\nhttps://altsp.su/obnovleniya-bezopasnosti/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-665, CWE-825",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u041d\u0435\u0442 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 0)"
}

CVE-2026-22988 (GCVE-0-2026-22988)

Vulnerability from cvelistv5 – Published: 2026-01-23 15:24 – Updated: 2026-08-05 12:19

Title

arp: do not assume dev_hard_header() does not change skb->head

Summary

In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after dev_hard_header() call.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/e432dbff342b95fe4…
https://git.kernel.org/stable/c/393525dee5c39acff…
https://git.kernel.org/stable/c/70bddc16491ef4681…
https://git.kernel.org/stable/c/029935507d0af6553…
https://git.kernel.org/stable/c/dd6ccec088adff4bd…
https://git.kernel.org/stable/c/949647e7771a4a019…
https://git.kernel.org/stable/c/c92510f5e3f82ba11…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 17e7386234f740f3e7d5e58a47b5847ea34c3bc2 , < e432dbff342b95fe44645f9a90fcf333c80f4b5e (git) Affected: 41a1a3140aff295dee8063906f70a514548105e8 , < 393525dee5c39acff8d6705275d7fcaabcfb7f0a (git) Affected: adee129db814474f2f81207bd182bf343832a52e , < 70bddc16491ef4681f3569b3a2c80309a3edcdd1 (git) Affected: 1717357007db150c2d703f13f5695460e960f26c , < 029935507d0af6553c45380fbf6feecf756fd226 (git) Affected: 5fe210533e3459197eabfdbf97327dacbdc04d60 , < dd6ccec088adff4bdf33e2b2dd102df20a7128fa (git) Affected: 91a2b25be07ce1a7549ceebbe82017551d2eec92 , < 949647e7771a4a01963fe953a96d81fba7acecf3 (git) Affected: db5b4e39c4e63700c68a7e65fc4e1f1375273476 , < c92510f5e3f82ba11c95991824a41e59a9c5ed81 (git)
Linux	Linux	Affected: 6.1.160 , < 6.1.161 (semver) Affected: 6.6.120 , < 6.6.121 (semver) Affected: 6.12.64 , < 6.12.66 (semver) Affected: 6.18.4 , < 6.18.6 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/arp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e432dbff342b95fe44645f9a90fcf333c80f4b5e",
              "status": "affected",
              "version": "17e7386234f740f3e7d5e58a47b5847ea34c3bc2",
              "versionType": "git"
            },
            {
              "lessThan": "393525dee5c39acff8d6705275d7fcaabcfb7f0a",
              "status": "affected",
              "version": "41a1a3140aff295dee8063906f70a514548105e8",
              "versionType": "git"
            },
            {
              "lessThan": "70bddc16491ef4681f3569b3a2c80309a3edcdd1",
              "status": "affected",
              "version": "adee129db814474f2f81207bd182bf343832a52e",
              "versionType": "git"
            },
            {
              "lessThan": "029935507d0af6553c45380fbf6feecf756fd226",
              "status": "affected",
              "version": "1717357007db150c2d703f13f5695460e960f26c",
              "versionType": "git"
            },
            {
              "lessThan": "dd6ccec088adff4bdf33e2b2dd102df20a7128fa",
              "status": "affected",
              "version": "5fe210533e3459197eabfdbf97327dacbdc04d60",
              "versionType": "git"
            },
            {
              "lessThan": "949647e7771a4a01963fe953a96d81fba7acecf3",
              "status": "affected",
              "version": "91a2b25be07ce1a7549ceebbe82017551d2eec92",
              "versionType": "git"
            },
            {
              "lessThan": "c92510f5e3f82ba11c95991824a41e59a9c5ed81",
              "status": "affected",
              "version": "db5b4e39c4e63700c68a7e65fc4e1f1375273476",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/arp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.161",
              "status": "affected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.121",
              "status": "affected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.66",
              "status": "affected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.6",
              "status": "affected",
              "version": "6.18.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.161",
                  "versionStartIncluding": "6.1.160",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.121",
                  "versionStartIncluding": "6.6.120",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.66",
                  "versionStartIncluding": "6.12.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.6",
                  "versionStartIncluding": "6.18.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: do not assume dev_hard_header() does not change skb-\u003ehead\n\narp_create() is the only dev_hard_header() caller\nmaking assumption about skb-\u003ehead being unchanged.\n\nA recent commit broke this assumption.\n\nInitialize @arp pointer after dev_hard_header() call."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The demonstrated trigger path is a local rtnetlink sendmsg that changes network device state and causes gratuitous ARP generation through arp_create(). Remote ARP paths can call arp_create(), but the UAF condition depends on locally controlled virtual device/headroom state such as ip6gre stacking.\nAC:L - Once the affected device configuration is present, triggering arp_create() and the ip6gre_header() head expansion is straightforward. Any needed setup or race is controlled by the local attacker through netlink operations.\nPR:L - The relevant rtnetlink operations require CAP_NET_ADMIN in the target network namespace. This is low privilege because an unprivileged local user can obtain CAP_NET_ADMIN in a new user/network namespace on systems with user namespaces enabled.\nUI:N - No victim action is required after the attacker performs the local network configuration and trigger operation. The vulnerable path runs in kernel networking code.\nS:U - The corruption occurs within the kernel networking subsystem and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug is a slab use-after-free write after pskb_expand_head() moves skb-\u003ehead, leaving arp_create() writing through a stale pointer. Kernel UAF memory corruption can be leveraged for information disclosure, so confidentiality impact is high.\nI:H - The stale ARP header pointer is used for attacker-influenced writes into freed kernel heap memory. This is memory corruption with plausible control-flow or object corruption exploitation, so integrity impact is high.\nA:H - KASAN reports confirm a slab-use-after-free write in arp_create(), and such corruption can directly crash or panic the kernel. Repeated triggering can cause system-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:19:56.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e432dbff342b95fe44645f9a90fcf333c80f4b5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/393525dee5c39acff8d6705275d7fcaabcfb7f0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/70bddc16491ef4681f3569b3a2c80309a3edcdd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/029935507d0af6553c45380fbf6feecf756fd226"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd6ccec088adff4bdf33e2b2dd102df20a7128fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/949647e7771a4a01963fe953a96d81fba7acecf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c92510f5e3f82ba11c95991824a41e59a9c5ed81"
        }
      ],
      "title": "arp: do not assume dev_hard_header() does not change skb-\u003ehead",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-22988",
    "datePublished": "2026-01-23T15:24:09.756Z",
    "dateReserved": "2026-01-13T15:37:45.937Z",
    "dateUpdated": "2026-08-05T12:19:56.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.