{"id":"CVE-2026-74720","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-20"],"vendor":"Linux","product":"Linux","affected":["Linux >= f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 < 86b203aadc2930e0a4f9c6277b5b80ff3664c472","Linux >= f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 < 8109c25e0c41f5f19a1c2380bb49c991a877494e","Linux >= f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 < d1959028190a7649b926f5867a58de5fe221b23c","Linux >= f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 < 8cb23101a3fcc7432b451ea3d0f14a90711f4acf","Linux >= f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 < 29c239f8dbec5ab33a61796724d189bddee6cd4b","Linux >= f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 < db6382ed3361bdd8129572a3423956cba1dae829","Linux >= f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 < eaffa1495e4fe6330aeff9f323ea3d48b01f118a","Linux >= f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 < a4c6f804b44c5c790269b25e0e61cf4e9f117c86","Linux 4.16"],"published":"2026-08-22","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:54.560","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74720","references":[{"url":"https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74720.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-74720"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521477"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74720"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74720"},{"url":"https://kernelcve.org/list/?q=CVE-2026-74720"},{"url":"https://lore.kernel.org/linux-cve-announce/2026082239-CVE-2026-74720-a11f@gregkh/T"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00129,"epssPercentile":0.0254,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:15:35.375502Z"},"ingestedAt":"2026-10-14T13:30:58.547Z","slug":"CVE-2026-74720","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller's temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74720.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}