CVE-2026-74720 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve pointer state for commuted arithmetic
When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields.
Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel’s Berkeley Packet Filter (BPF) subsystem serves as a critical infrastructure component, enabling high-performance packet processing and observability by allowing user-space programs to execute safely within the kernel space via a virtual machine architecture. A significant aspect of this security model is the verifier, which statically analyzes BPF programs before they are loaded to ensure memory safety, prevent invalid operations, and guarantee that the program will terminate without causing system instability or privilege escalation. The integrity of the verifier relies heavily on its ability to accurately track register states throughout the execution flow of a BPF program, particularly distinguishing between scalar values representing numeric offsets and pointers referencing specific kernel memory regions such as stack frames or map elements.
A vulnerability was identified in the handling of commuted arithmetic operations within the adjust_ptr_min_max_vals function, specifically when a scalar value is added to a pointer register using the addition assignment operator. In this scenario, the destination register incorrectly inherited only selected fields from the source pointer rather than its complete state structure. This partial copying mechanism proved fragile because BPF relies on multiple reg_state fields to track complex pointer provenance attributes, including frame numbers for stack pointers and parent identity fields that maintain context across function calls or map lookups. By failing to preserve these critical metadata components during arithmetic operations involving commuted operands, the verifier’s internal state representation became inconsistent with the actual program logic, creating a gap in static analysis coverage.
The operational impact of this flaw allows an attacker who can load malicious BPF programs to potentially bypass security restrictions enforced by the verifier. Since the pointer provenance information is corrupted or lost during these specific arithmetic operations, the verifier may incorrectly validate instructions that should have been rejected due to invalid memory access patterns or type mismatches. This could lead to situations where a BPF program accesses kernel memory outside of its permitted bounds, reads uninitialized stack data, or manipulates control flow in ways not intended by the programmer. Such vulnerabilities fall under CWE-20 Improper Input Validation and CWE-754 Incorrect Check for Unusual or Exceptional Conditions, as they stem from flawed logic in handling edge cases within arithmetic operations that compromise the integrity of state tracking mechanisms essential for memory safety guarantees.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1068 Exploitation for Privilege Escalation if exploited to gain higher privileges through kernel code execution, or T1530 Data from Local System if used to read sensitive kernel memory contents that were previously protected by verifier checks. The exploitation vector typically involves crafting a BPF program that triggers the commuted arithmetic path within adjust_ptr_min_max_vals while relying on the corrupted pointer state to pass subsequent verification steps that would otherwise fail due to strict provenance requirements for stack or map pointers.
Mitigation strategies primarily involve applying the upstream kernel patch that resolves this issue by modifying how register states are handled during these operations. The fix ensures that when a scalar is added to a pointer, the destination register receives the full pointer state from the source, while using a temporary offset register to preserve the scalar operand’s value separately. This approach maintains consistency in frame numbers for PTR_TO_STACK registers and keeps parent identity fields intact, thereby restoring the verifier's ability to accurately track memory access patterns and prevent invalid operations. System administrators should ensure that their Linux kernels are updated to versions containing this fix, particularly those running environments with heavy reliance on eBPF-based security tools or network monitoring agents where custom BPF programs might be loaded dynamically.