From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic
Date: Sat, 22 Aug 2026 17:33:24 +0200 [thread overview]
Message-ID: <2026082239-CVE-2026-74720-a11f@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve pointer state for commuted arithmetic
When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.
Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.
The Linux kernel CVE team has assigned CVE-2026-74720 to this issue.
Affected and fixed versions
===========================
Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 5.10.265 with commit 86b203aadc2930e0a4f9c6277b5b80ff3664c472
Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 5.15.216 with commit 8109c25e0c41f5f19a1c2380bb49c991a877494e
Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 6.1.183 with commit d1959028190a7649b926f5867a58de5fe221b23c
Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 6.6.152 with commit 8cb23101a3fcc7432b451ea3d0f14a90711f4acf
Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 6.12.104 with commit 29c239f8dbec5ab33a61796724d189bddee6cd4b
Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 6.18.45 with commit db6382ed3361bdd8129572a3423956cba1dae829
Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 7.1.9 with commit eaffa1495e4fe6330aeff9f323ea3d48b01f118a
Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 7.2 with commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-74720
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
kernel/bpf/verifier.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472
https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e
https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c
https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf
https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b
https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829
https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a
https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86
reply other threads:[~2026-08-22 15:40 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026082239-CVE-2026-74720-a11f@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.