CVE-2026-74720

bpf: Preserve pointer state for commuted arithmetic

State: Published
Severity: 7.8 High
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer state for commuted arithmetic

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before 86b203aadc2930e0a4f9c6277b5b80ff3664c472Affected f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before 8109c25e0c41f5f19a1c2380bb49c991a877494eAffected f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before d1959028190a7649b926f5867a58de5fe221b23cAffected f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before 8cb23101a3fcc7432b451ea3d0f14a90711f4acfAffected f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before 29c239f8dbec5ab33a61796724d189bddee6cd4bAffected f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before db6382ed3361bdd8129572a3423956cba1dae829Affected f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before eaffa1495e4fe6330aeff9f323ea3d48b01f118aAffected f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before a4c6f804b44c5c790269b25e0e61cf4e9f117c86Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before 86b203aadc2930e0a4f9c6277b5b80ff3664c472Affected
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before 8109c25e0c41f5f19a1c2380bb49c991a877494eAffected
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before d1959028190a7649b926f5867a58de5fe221b23cAffected
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before 8cb23101a3fcc7432b451ea3d0f14a90711f4acfAffected
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before 29c239f8dbec5ab33a61796724d189bddee6cd4bAffected
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before db6382ed3361bdd8129572a3423956cba1dae829Affected
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before eaffa1495e4fe6330aeff9f323ea3d48b01f118aAffected
f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 to before a4c6f804b44c5c790269b25e0e61cf4e9f117c86Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.