In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer state for commuted arithmetic

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b cve-icon cve-icon
https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e cve-icon cve-icon
https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472 cve-icon cve-icon
https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf cve-icon cve-icon
https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86 cve-icon cve-icon
https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c cve-icon cve-icon
https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829 cve-icon cve-icon
https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a cve-icon cve-icon
History

Sat, 22 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
Title bpf: Preserve pointer state for commuted arithmetic
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-22T15:33:13.342Z

Reserved: 2026-08-15T05:44:03.929Z

Link: CVE-2026-74720

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-22T16:16:46.957

Modified: 2026-08-22T16:16:46.957

Link: CVE-2026-74720

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T18:00:04Z

Weaknesses