CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve pointer state for commuted arithmetic
When scalar += pointer is handled in adjustptrminmaxvals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpfregstate fields.
Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTRTOSTACK registers and keeps parent identity fields consistent.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to reach the affected code path?
The issue is triggered when the BPF verifier handles commuted arithmetic in which a scalar is added to a pointer, specifically the scalar += pointer case in adjust_ptr_min_max_vals(). The provided information does not identify a particular BPF program source, privilege level, or runtime configuration required to submit such a program.
What pointer types or verifier state can be affected?
PTR_TO_STACK register handling is specifically affected because incomplete pointer-state copying can lose the frame number. Parent identity fields can also become inconsistent because pointer provenance is tracked across several bpf_reg_state fields.
What does the fix change?
The fix preserves the scalar operand in a temporary offset register and replaces the destination register with the complete state of the source pointer. This avoids copying only selected pointer-state fields and preserves provenance, frame-number, and parent-identity information.