Linux Kernel BPF: Pointer State Preservation Vulnerability
CVE-2026-74720 Published on August 22, 2026
bpf: Preserve pointer state for commuted arithmetic
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve pointer state for commuted arithmetic
When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.
Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.
Products Associated with CVE-2026-74720
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and below 86b203aadc2930e0a4f9c6277b5b80ff3664c472 is affected.
- Version f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and below 8109c25e0c41f5f19a1c2380bb49c991a877494e is affected.
- Version f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and below d1959028190a7649b926f5867a58de5fe221b23c is affected.
- Version f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and below 8cb23101a3fcc7432b451ea3d0f14a90711f4acf is affected.
- Version f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and below 29c239f8dbec5ab33a61796724d189bddee6cd4b is affected.
- Version f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and below db6382ed3361bdd8129572a3423956cba1dae829 is affected.
- Version f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and below eaffa1495e4fe6330aeff9f323ea3d48b01f118a is affected.
- Version f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and below a4c6f804b44c5c790269b25e0e61cf4e9f117c86 is affected.
- Version 4.16 is affected.
- Before 4.16 is unaffected.
- Version 5.10.265, <= 5.10.* is unaffected.
- Version 5.15.216, <= 5.15.* is unaffected.
- Version 6.1.183, <= 6.1.* is unaffected.
- Version 6.6.152, <= 6.6.* is unaffected.
- Version 6.12.104, <= 6.12.* is unaffected.
- Version 6.18.45, <= 6.18.* is unaffected.
- Version 7.1.9, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.