{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74720", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.929Z", "datePublished": "2026-08-22T15:33:13.342Z", "dateUpdated": "2026-08-25T05:42:01.009Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:42:01.009Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller's temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is in bpf_check()/adjust_ptr_min_max_vals() during bpf(BPF_PROG_LOAD) via the local bpf(2) syscall; per kernel CNA guidance BPF verifier bugs are Local, not reachable from remote network packet handling.\nAC:L - An attacker fully controls BPF bytecode using commuted 64-bit scalar+=pointer ALU and bpf2bpf call chains, deterministically poisoning register state during verification without races or external preconditions.\nPR:L - Exploitation requires loading bpf2bpf programs (CAP_BPF-gated), which is routinely available to unprivileged users via user namespaces/BPF token delegation or unprivileged socket-filter loading when kernel.unprivileged_bpf_disabled=0, not init-namespace root.\nUI:N - The attacker loads and executes their own crafted BPF program through bpf(2); no separate victim action such as mounting filesystems or opening files is required beyond the attacker's own local access.\nS:U - Impact is a BPF verifier bypass enabling in-kernel out-of-bounds memory access and privilege escalation within the host kernel's security authority; it does not cross VM, IOMMU, or sandbox boundaries.\nC:H - Copying only type/id on scalar+=pointer leaves stale frameno, var_off, and map/parent metadata, so bpf_func() stack checks validate the wrong frame and approve out-of-bounds reads of adjacent kernel memory.\nI:H - The same incorrect pointer provenance permits verifier-approved out-of-bounds BPF stack/map writes at runtime, a controllable kernel memory corruption primitive leverageable for arbitrary modification and privilege escalation.\nA:H - Out-of-bounds BPF memory accesses from the bypassed verifier state can corrupt critical kernel data or dereference invalid addresses, reliably causing kernel oops/panic and repeatable denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "lessThan": "86b203aadc2930e0a4f9c6277b5b80ff3664c472", "status": "affected", "versionType": "git"}, {"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "lessThan": "8109c25e0c41f5f19a1c2380bb49c991a877494e", "status": "affected", "versionType": "git"}, {"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "lessThan": "d1959028190a7649b926f5867a58de5fe221b23c", "status": "affected", "versionType": "git"}, {"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "lessThan": "8cb23101a3fcc7432b451ea3d0f14a90711f4acf", "status": "affected", "versionType": "git"}, {"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "lessThan": "29c239f8dbec5ab33a61796724d189bddee6cd4b", "status": "affected", "versionType": "git"}, {"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "lessThan": "db6382ed3361bdd8129572a3423956cba1dae829", "status": "affected", "versionType": "git"}, {"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "lessThan": "eaffa1495e4fe6330aeff9f323ea3d48b01f118a", "status": "affected", "versionType": "git"}, {"version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "lessThan": "a4c6f804b44c5c790269b25e0e61cf4e9f117c86", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "4.16", "status": "affected"}, {"version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472"}, {"url": "https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e"}, {"url": "https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c"}, {"url": "https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf"}, {"url": "https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b"}, {"url": "https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829"}, {"url": "https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a"}, {"url": "https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86"}], "title": "bpf: Preserve pointer state for commuted arithmetic", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "86b203aadc2930e0a4f9c6277b5b80ff3664c472", "status": "affected", "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "versionType": "git"}, {"lessThan": "8109c25e0c41f5f19a1c2380bb49c991a877494e", "status": "affected", "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "versionType": "git"}, {"lessThan": "d1959028190a7649b926f5867a58de5fe221b23c", "status": "affected", "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "versionType": "git"}, {"lessThan": "8cb23101a3fcc7432b451ea3d0f14a90711f4acf", "status": "affected", "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "versionType": "git"}, {"lessThan": "29c239f8dbec5ab33a61796724d189bddee6cd4b", "status": "affected", "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "versionType": "git"}, {"lessThan": "db6382ed3361bdd8129572a3423956cba1dae829", "status": "affected", "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "versionType": "git"}, {"lessThan": "eaffa1495e4fe6330aeff9f323ea3d48b01f118a", "status": "affected", "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "versionType": "git"}, {"lessThan": "a4c6f804b44c5c790269b25e0e61cf4e9f117c86", "status": "affected", "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.16"}, {"lessThan": "4.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller's temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent."}], "id": "CVE-2026-74720", "lastModified": "2026-08-25T06:18:57.637", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:46.957", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Preserve pointer state for commuted arithmetic", "id": "2521477", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521477"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-823", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Preserve pointer state for commuted arithmetic\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\nUse the caller's temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. When a scalar value is added to a pointer during certain arithmetic operations, the system fails to fully preserve the pointer's state. This inconsistency in how the pointer's origin and properties are tracked can lead to memory corruption or information disclosure. An attacker could potentially leverage this to impact system stability or gain unauthorized access to sensitive data."], "name": "CVE-2026-74720", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74720\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74720\nhttps://lore.kernel.org/linux-cve-announce/2026082239-CVE-2026-74720-a11f@gregkh/T"], "threat_severity": "Moderate"}