CVE-2026-22988

A use-after-free vulnerability was found in the Linux kernel's ARP implementation. The arp_create() function initializes a pointer to the ARP header before calling dev_hard_header(), incorrectly assuming that skb->head will not change. A recent kernel change broke this assumption, causing the @arp pointer to reference stale memory after dev_hard_header() potentially reallocates the socket buffer.

This vulnerability was introduced by a recent kernel change that modified dev_hard_header() behavior. The stale pointer access could lead to memory corruption or information disclosure during ARP packet creation. The issue affects network operations but requires specific device driver behavior to trigger the buffer reallocation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.