GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74720 (GCVE-0-2026-74720)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
Title
bpf: Preserve pointer state for commuted arithmetic
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < 86b203aadc2930e0a4f9c6277b5b80ff3664c472 (git)
Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < 8109c25e0c41f5f19a1c2380bb49c991a877494e (git)
Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < d1959028190a7649b926f5867a58de5fe221b23c (git)
Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < 8cb23101a3fcc7432b451ea3d0f14a90711f4acf (git)
Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < 29c239f8dbec5ab33a61796724d189bddee6cd4b (git)
Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < db6382ed3361bdd8129572a3423956cba1dae829 (git)
Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < eaffa1495e4fe6330aeff9f323ea3d48b01f118a (git)
Affected: f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 , < a4c6f804b44c5c790269b25e0e61cf4e9f117c86 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86b203aadc2930e0a4f9c6277b5b80ff3664c472",
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "versionType": "git"
            },
            {
              "lessThan": "8109c25e0c41f5f19a1c2380bb49c991a877494e",
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "versionType": "git"
            },
            {
              "lessThan": "d1959028190a7649b926f5867a58de5fe221b23c",
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "versionType": "git"
            },
            {
              "lessThan": "8cb23101a3fcc7432b451ea3d0f14a90711f4acf",
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "versionType": "git"
            },
            {
              "lessThan": "29c239f8dbec5ab33a61796724d189bddee6cd4b",
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "versionType": "git"
            },
            {
              "lessThan": "db6382ed3361bdd8129572a3423956cba1dae829",
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "versionType": "git"
            },
            {
              "lessThan": "eaffa1495e4fe6330aeff9f323ea3d48b01f118a",
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "versionType": "git"
            },
            {
              "lessThan": "a4c6f804b44c5c790269b25e0e61cf4e9f117c86",
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller\u0027s temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in bpf_check()/adjust_ptr_min_max_vals() during bpf(BPF_PROG_LOAD) via the local bpf(2) syscall; per kernel CNA guidance BPF verifier bugs are Local, not reachable from remote network packet handling.\nAC:L - An attacker fully controls BPF bytecode using commuted 64-bit scalar+=pointer ALU and bpf2bpf call chains, deterministically poisoning register state during verification without races or external preconditions.\nPR:L - Exploitation requires loading bpf2bpf programs (CAP_BPF-gated), which is routinely available to unprivileged users via user namespaces/BPF token delegation or unprivileged socket-filter loading when kernel.unprivileged_bpf_disabled=0, not init-namespace root.\nUI:N - The attacker loads and executes their own crafted BPF program through bpf(2); no separate victim action such as mounting filesystems or opening files is required beyond the attacker\u0027s own local access.\nS:U - Impact is a BPF verifier bypass enabling in-kernel out-of-bounds memory access and privilege escalation within the host kernel\u0027s security authority; it does not cross VM, IOMMU, or sandbox boundaries.\nC:H - Copying only type/id on scalar+=pointer leaves stale frameno, var_off, and map/parent metadata, so bpf_func() stack checks validate the wrong frame and approve out-of-bounds reads of adjacent kernel memory.\nI:H - The same incorrect pointer provenance permits verifier-approved out-of-bounds BPF stack/map writes at runtime, a controllable kernel memory corruption primitive leverageable for arbitrary modification and privilege escalation.\nA:H - Out-of-bounds BPF memory accesses from the bypassed verifier state can corrupt critical kernel data or dereference invalid addresses, reliably causing kernel oops/panic and repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:42:01.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472"
        },
        {
          "url": "https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf"
        },
        {
          "url": "https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86"
        }
      ],
      "title": "bpf: Preserve pointer state for commuted arithmetic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74720",
    "datePublished": "2026-08-22T15:33:13.342Z",
    "dateReserved": "2026-08-15T05:44:03.929Z",
    "dateUpdated": "2026-08-25T05:42:01.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74720",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.0293"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:50:12.000Z",
      "cve": "CVE-2026-74720",
      "id": "msrc_CVE-2026-74720",
      "initial_release_date": "2026-08-24T01:07:33.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Preserve pointer state for commuted arithmetic",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74720.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74720\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:46.957\",\"lastModified\":\"2026-08-25T06:18:57.637\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Preserve pointer state for commuted arithmetic\\n\\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\\ndestination register inherits the pointer state from the source pointer.\\nCopying only selected fields is fragile because pointer provenance is\\ntracked by several bpf_reg_state fields.\\n\\nUse the caller\u0027s temporary offset register to preserve the scalar operand\\nwhile replacing the destination with the full pointer state. This preserves\\nthe frame number for PTR_TO_STACK registers and keeps parent identity\\nfields consistent.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/verifier.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f4d7e40a5b7157e1329c3c5b10f60d8289fc2941\",\"lessThan\":\"86b203aadc2930e0a4f9c6277b5b80ff3664c472\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f4d7e40a5b7157e1329c3c5b10f60d8289fc2941\",\"lessThan\":\"8109c25e0c41f5f19a1c2380bb49c991a877494e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f4d7e40a5b7157e1329c3c5b10f60d8289fc2941\",\"lessThan\":\"d1959028190a7649b926f5867a58de5fe221b23c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f4d7e40a5b7157e1329c3c5b10f60d8289fc2941\",\"lessThan\":\"8cb23101a3fcc7432b451ea3d0f14a90711f4acf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f4d7e40a5b7157e1329c3c5b10f60d8289fc2941\",\"lessThan\":\"29c239f8dbec5ab33a61796724d189bddee6cd4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f4d7e40a5b7157e1329c3c5b10f60d8289fc2941\",\"lessThan\":\"db6382ed3361bdd8129572a3423956cba1dae829\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f4d7e40a5b7157e1329c3c5b10f60d8289fc2941\",\"lessThan\":\"eaffa1495e4fe6330aeff9f323ea3d48b01f118a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f4d7e40a5b7157e1329c3c5b10f60d8289fc2941\",\"lessThan\":\"a4c6f804b44c5c790269b25e0e61cf4e9f117c86\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/verifier.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:55:54+00:00",
      "cve": "CVE-2026-74720",
      "id": "CVE-2026-74720",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Preserve pointer state for commuted arithmetic",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74720.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:15:49Z",
      "cve": "CVE-2026-74720",
      "id": "CVE-2026-74720",
      "initial_release_date": "2026-08-23T00:03:59Z",
      "product_status:known_affected": "351",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74720",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74720.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.