CVE-2026-74720 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.

Is your site exposed to CVE-2026-74720?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0013

Probability of exploitation

0.03%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472 https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86 https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829 https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a

Frequently Asked Questions

What is CVE-2026-74720? +

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-74720? +

CVE-2026-74720 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0013, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-74720? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-74720