Linux kernel BPF verifier: commuted pointer arithmetic loses pointer provenance state

CVE-2026-74720Kernel, userspace & hypervisorcurated

Impact

When the verifier handles scalar += pointer, the destination register inherits only selected fields of the source pointer state, while provenance is actually tracked across several bpf_reg_state fields - the frame number for PTR_TO_STACK and the parent identity fields among them. The fix replaces the destination with the full pointer state instead of copying pieces. The record describes fragile state tracking, not a demonstrated sandbox escape, and gives no CVSS or CWE; treat it as a verifier hardening fix whose worst case is mis-tracked pointer state. It matters on a shared fleet because verifier state bugs are the usual route from BPF program loading to kernel memory access.

Who can reach it

Anyone able to load a BPF program. On a default fleet that means root or CAP_BPF - unprivileged BPF is disabled by default - so the realistic loaders are the CNI, observability agents and node tooling. On hosts where unprivileged BPF has been re-enabled, any local user including a tenant pod.

What to do

Update to a stable kernel with the fix and reboot at the next kernel roll. In the meantime, confirm kernel.unprivileged_bpf_disabled is set and audit which workloads hold CAP_BPF - that is a sysctl and a policy check, not a drain, and it bounds who can reach the verifier at all.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-74720 https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.