bpf: Preserve pointer state for commuted arithmetic
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.265, 5.15.216, 6.1.183, 6.12.104, 6.18.45, 6.6.152, 7.1.9
- CVEs
- CVE-2026-74720
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:50 UTC · Revision 1
Source evidence
bpf: Preserve pointer state for commuted arithmetic
core-osv · Original sourcePublished 22 Aug 2026, 15:33 UTC
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
osv:CVE-2026-74720
Kernel
Fixed versions: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9
Complete source record
{
"id": "17d3463e870246506a28dcb837872d17b444617033edb3b6ec38e3b3135bdc54",
"url": "https://osv.dev/vulnerability/CVE-2026-74720",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "bpf: Preserve pointer state for commuted arithmetic",
"summary": "In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.",
"evidence": "osv:CVE-2026-74720",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.265",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.216",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.183",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.152",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.104",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.45",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.9",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-74720",
"aliases": [
"CVE-2026-74720"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941"
},
{
"fixed": "86b203aadc2930e0a4f9c6277b5b80ff3664c472"
},
{
"fixed": "8109c25e0c41f5f19a1c2380bb49c991a877494e"
},
{
"fixed": "d1959028190a7649b926f5867a58de5fe221b23c"
},
{
"fixed": "8cb23101a3fcc7432b451ea3d0f14a90711f4acf"
},
{
"fixed": "29c239f8dbec5ab33a61796724d189bddee6cd4b"
},
{
"fixed": "db6382ed3361bdd8129572a3423956cba1dae829"
},
{
"fixed": "eaffa1495e4fe6330aeff9f323ea3d48b01f118a"
},
{
"fixed": "a4c6f804b44c5c790269b25e0e61cf4e9f117c86"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74720.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.16.0"
},
{
"fixed": "5.10.265"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.216"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.183"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.152"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.104"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.45"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.9"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74720.json"
}
}
],
"modified": "2026-10-28T02:30:32.826719627Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b",
"https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e",
"https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472",
"https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf",
"https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86",
"https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c",
"https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829",
"https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74720.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-74720",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74720.json"
}
},
"related_cves": [
{
"value": "CVE-2026-74720",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 500105,
"published_at": "2026-08-22T15:33:13.342+00:00"
}