CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic
bpf: Preserve pointer state for commuted arithmetic
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What conditions are required to reach the affected code path?
The issue is triggered when the BPF verifier handles commuted arithmetic in which a scalar is added to a pointer, specifically the scalar += pointer case in adjust_ptr_min_max_vals(). The provided information does not identify a particular BPF program source, privilege level, or runtime configuration required to submit such a program.
What pointer types or verifier state can be affected?
PTR_TO_STACK register handling is specifically affected because incomplete pointer-state copying can lose the frame number. Parent identity fields can also become inconsistent because pointer provenance is tracked across several bpf_reg_state fields.
What does the fix change?
The fix preserves the scalar operand in a temporary offset register and replaces the destination register with the complete state of the source pointer. This avoids copying only selected pointer-state fields and preserves provenance, frame-number, and parent-identity information.