CVE-2026-74720 - Vulnerability Details

- bpf: Preserve pointer state for commuted arithmetic

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer state for commuted arithmetic

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.

Published: 2026-08-22

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s BPF verifier contains a defect in the adjust_ptr_min_max_vals() routine. When a scalar operand is added to a pointer, the destination register inherits pointer state from the source pointer, copying only selected fields. This fragile handling can lead to incorrect pointer provenance metadata and potentially cause improper memory accesses. The weakness is classified as CWE‑823.

Affected Systems

Linux kernel versions that include the adjust_ptr_min_max_vals() logic in the BPF verifier and support eBPF programs are affected.

Risk and Exploitability

The vulnerability has a CVSS score of 7.8, indicating moderate severity. Its EPSS score is reported as <1%, implying a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Based on how pointer provenance is handled, it is inferred that malicious eBPF code executed in kernel mode could exploit this flaw. The attack would require the ability to load custom BPF programs into the affected kernel, which is a local attack vector.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< 86b203aadc2930e0a4f9c6277b5b80ff3664c472
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< 8109c25e0c41f5f19a1c2380bb49c991a877494e
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< d1959028190a7649b926f5867a58de5fe221b23c
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< 8cb23101a3fcc7432b451ea3d0f14a90711f4acf
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< 29c239f8dbec5ab33a61796724d189bddee6cd4b
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< db6382ed3361bdd8129572a3423956cba1dae829
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< eaffa1495e4fe6330aeff9f323ea3d48b01f118a
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< a4c6f804b44c5c790269b25e0e61cf4e9f117c86

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,86b203aadc2930e0a4f9c6277b5b80ff3664c472)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,8109c25e0c41f5f19a1c2380bb49c991a877494e)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,d1959028190a7649b926f5867a58de5fe221b23c)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,8cb23101a3fcc7432b451ea3d0f14a90711f4acf)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,29c239f8dbec5ab33a61796724d189bddee6cd4b)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,db6382ed3361bdd8129572a3423956cba1dae829)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,eaffa1495e4fe6330aeff9f323ea3d48b01f118a)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,a4c6f804b44c5c790269b25e0e61cf4e9f117c86)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	generic	—
`[5.10.265,5.10.*]`	unaffected	generic	—
`[5.15.216,5.15.*]`	unaffected	generic	—
`[6.1.183,6.1.*]`	unaffected	generic	—
`[6.6.152,6.6.*]`	unaffected	generic	—
`[6.12.104,6.12.*]`	unaffected	generic	—
`[6.18.45,6.18.*]`	unaffected	generic	—
`[7.1.9,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the fix for adjust_ptr_min_max_vals().
If a timely update is unavailable, disable eBPF execution by setting net.core.bpf_jit_enable=0 or by recompiling the kernel without CONFIG_BPF, thereby preventing the loading of new BPF programs.
To further restrict the risk, limit BPF program loading to trusted users by revoking CAP_SYS_ADMIN privileges from untrusted processes or by enforcing LSM policies that deny BPF operations from non‑privileged accounts.

Generated by OpenCVE AI on August 25, 2026 at 18:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00129.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b
https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e
https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472
https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf
https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86
https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c
https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829
https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a
https://lore.kernel.org/linux-cve-announce/2026082239-CVE-2026-74720-a11f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74720
https://www.cve.org/CVERecord?id=CVE-2026-74720

History

Tue, 25 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-190 CWE-416

Tue, 25 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-823
References		https://lore.kernel.org/linux-cve-announce/2026082239-CVE-2026-74720-a11f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74720 https://www.cve.org/CVERecord?id=CVE-2026-74720
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 25 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 22 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190 CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
Title		bpf: Preserve pointer state for commuted arithmetic
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472 https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86 https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829 https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:33:13.342Z

Updated: 2026-08-25T05:42:01.009Z

Reserved: 2026-08-15T05:44:03.929Z

Link: CVE-2026-74720

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:46.957

Modified: 2026-08-25T06:18:57.637

Link: CVE-2026-74720

Redhat

Severity : Moderate

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74720 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-25T18:15:04Z

Weaknesses

CWE-823
Use of Out-of-range Pointer Offset

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object