CVE-2026-74720

bpf: Preserve pointer state for commuted arithmetic

Published Aug 22, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer state for commuted arithmetic

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.

Analysis

Technical impact

The Linux kernel’s BPF verifier contains a defect in the adjust_ptr_min_max_vals() routine. When a scalar operand is added to a pointer, the destination register inherits pointer state from the source pointer, copying only selected fields. This fragile handling can lead to incorrect pointer provenance metadata and potentially cause improper memory accesses. The weakness is classified as CWE‑823.

Affected Systems

Linux kernel versions that include the adjust_ptr_min_max_vals() logic in the BPF verifier and support eBPF programs are affected.

Risk and Exploitability

The vulnerability has a CVSS score of 7.8, indicating moderate severity. Its EPSS score is reported as <1%, implying a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Based on how pointer provenance is handled, it is inferred that malicious eBPF code executed in kernel mode could exploit this flaw. The attack would require the ability to load custom BPF programs into the affected kernel, which is a local attack vector.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< 86b203aadc2930e0a4f9c6277b5b80ff3664c472
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< 8109c25e0c41f5f19a1c2380bb49c991a877494e
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< d1959028190a7649b926f5867a58de5fe221b23c
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< 8cb23101a3fcc7432b451ea3d0f14a90711f4acf
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< 29c239f8dbec5ab33a61796724d189bddee6cd4b
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< db6382ed3361bdd8129572a3423956cba1dae829
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< eaffa1495e4fe6330aeff9f323ea3d48b01f118a
`f4d7e40a5b7157e1329c3c5b10f60d8289fc2941`	affected	< a4c6f804b44c5c790269b25e0e61cf4e9f117c86

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,86b203aadc2930e0a4f9c6277b5b80ff3664c472)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,8109c25e0c41f5f19a1c2380bb49c991a877494e)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,d1959028190a7649b926f5867a58de5fe221b23c)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,8cb23101a3fcc7432b451ea3d0f14a90711f4acf)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,29c239f8dbec5ab33a61796724d189bddee6cd4b)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,db6382ed3361bdd8129572a3423956cba1dae829)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,eaffa1495e4fe6330aeff9f323ea3d48b01f118a)`	affected	code_commit	—
`[f4d7e40a5b7157e1329c3c5b10f60d8289fc2941,a4c6f804b44c5c790269b25e0e61cf4e9f117c86)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	generic	—
`[5.10.265,5.10.*]`	unaffected	generic	—
`[5.15.216,5.15.*]`	unaffected	generic	—
`[6.1.183,6.1.*]`	unaffected	generic	—
`[6.6.152,6.6.*]`	unaffected	generic	—
`[6.12.104,6.12.*]`	unaffected	generic	—
`[6.18.45,6.18.*]`	unaffected	generic	—
`[7.1.9,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the fix for adjust_ptr_min_max_vals().
If a timely update is unavailable, disable eBPF execution by setting net.core.bpf_jit_enable=0 or by recompiling the kernel without CONFIG_BPF, thereby preventing the loading of new BPF programs.
To further restrict the risk, limit BPF program loading to trusted users by revoking CAP_SYS_ADMIN privileges from untrusted processes or by enforcing LSM policies that deny BPF operations from non‑privileged accounts.

Generated by OpenCVE AI on August 25, 2026 at 18:14 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.129% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b
https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e
https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472
https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf
https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86
https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c
https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829
https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a
https://lore.kernel.org/linux-cve-announce/2026082239-CVE-2026-74720-a11f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74720
https://www.cve.org/CVERecord?id=CVE-2026-74720

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 3:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-190 CWE-416

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-823
References		https://lore.kernel.org/linux-cve-announce/2026082239-CVE-2026-74720-a11f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74720 https://www.cve.org/CVERecord?id=CVE-2026-74720
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Aug 22, 2026 6:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-190 CWE-416

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
Title		bpf: Preserve pointer state for commuted arithmetic
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472 https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86 https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829 https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a