CVE-2026-74720

Received Received - Intake

BPF Pointer State Preservation in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-25

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74720

EUVD

EUVD-2026-64407

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of pointer arithmetic in the BPF subsystem. When a scalar value is added to a pointer, the system fails to properly preserve the pointer's state, which can lead to memory corruption or undefined behavior due to improper tracking of pointer provenance.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation. Detection requires checking the kernel version and BPF-related components. Use commands like 'uname -a' to check kernel version and 'dmesg | grep -i bpf' to look for BPF-related errors or warnings.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code, escalate privileges, or cause a denial of service by exploiting incorrect pointer arithmetic in BPF programs. It primarily affects systems running vulnerable Linux kernel versions.

Compliance Impact

The provided CVE data does not describe any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability relates to pointer state handling in the Linux kernel's BPF subsystem, which may affect memory safety but does not explicitly mention data protection or privacy implications required for such regulations.

Mitigation Strategies

Apply the latest kernel patches or updates from your Linux distribution to ensure the BPF-related fix is included. If patches are unavailable, consider disabling BPF functionality if not required, or restrict BPF usage via kernel parameters.

Hi! I’m here to help you understand CVE-2026-74720. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70